Splunk Search

Separting the string in splunk

mayank101
New Member

I have various search string under the field name entity:

            Entity

1 GBP:BOOT2NDSUNQTR_MAINT4_lonlx11067
2 GBP:BOOT2NDSUNMONTH_MAINT3_redlxd00130
3 AMP:BOOT2NDSATMONTH_MAINT4_psclxd00034
4 AMP:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_totlxfidevsp126
.
.
.
and so on

I want host name to be extracted such as lonlx11067,totlxfidevsp126 and do on. Could you help me in writing the query for the same I am particularly new to this

Tags (1)
0 Karma
1 Solution

nick405060
Motivator

Write your extraction rex.

... | rex field=Entity "_(?<host>[^_]+?)$" | table Entity host

View solution in original post

0 Karma

nick405060
Motivator

Write your extraction rex.

... | rex field=Entity "_(?<host>[^_]+?)$" | table Entity host
0 Karma

mayank101
New Member

I did not understood what you said.What is extraction rex

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...