Simple Search

[daniel333]

Sorry, I don't use Splunk much so I am sure this is an easy search for you all.

I am trying to get a complete list of domains that I am currently pulling data from. I got as far as this index=apache | dedup host which as a list of hosts. Now I just want the domain portion of it.

The hostname is always 12 characters long. So I am hoping there is just a way count 13 characters from the left of the host name and then dedup on the results of the domain and sort.

But I am lost on how to go at that.

[bmacias84]

I hope I understand your question.

Here are a couple of approaches :

using: rex

rex field=host "(?i)(?[^\s])(?:(.com)|(.net))"

Using substring:

index=apache | dedup host | eval nhost = substr(host, 1,13 ) | ...

Additional Reading:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/rex

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions