Splunk Search

Separting the string in splunk

mayank101
New Member

I have various search string under the field name entity:

            Entity

1 GBP:BOOT2NDSUNQTR_MAINT4_lonlx11067
2 GBP:BOOT2NDSUNMONTH_MAINT3_redlxd00130
3 AMP:BOOT2NDSATMONTH_MAINT4_psclxd00034
4 AMP:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_totlxfidevsp126
.
.
.
and so on

I want host name to be extracted such as lonlx11067,totlxfidevsp126 and do on. Could you help me in writing the query for the same I am particularly new to this

Tags (1)
0 Karma
1 Solution

nick405060
Motivator

Write your extraction rex.

... | rex field=Entity "_(?<host>[^_]+?)$" | table Entity host

View solution in original post

0 Karma

nick405060
Motivator

Write your extraction rex.

... | rex field=Entity "_(?<host>[^_]+?)$" | table Entity host
0 Karma

mayank101
New Member

I did not understood what you said.What is extraction rex

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...