Splunk Search

Separting the string in splunk

mayank101
New Member

I have various search string under the field name entity:

            Entity

1 GBP:BOOT2NDSUNQTR_MAINT4_lonlx11067
2 GBP:BOOT2NDSUNMONTH_MAINT3_redlxd00130
3 AMP:BOOT2NDSATMONTH_MAINT4_psclxd00034
4 AMP:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_totlxfidevsp126
.
.
.
and so on

I want host name to be extracted such as lonlx11067,totlxfidevsp126 and do on. Could you help me in writing the query for the same I am particularly new to this

Tags (1)
0 Karma
1 Solution

nick405060
Motivator

Write your extraction rex.

... | rex field=Entity "_(?<host>[^_]+?)$" | table Entity host

View solution in original post

0 Karma

nick405060
Motivator

Write your extraction rex.

... | rex field=Entity "_(?<host>[^_]+?)$" | table Entity host
0 Karma

mayank101
New Member

I did not understood what you said.What is extraction rex

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...