Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Using regex to extract word after semicolons
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I am attempt to extra host names from logs they always appear after the 4th semicolon :
E.g. I want the extra the "hostname" as a field and ignore all the characters and spaces before the 4th semicolon (:)
May 19 10:09:41 server1 Device: Script Completed Successfully: hostname1
May 19 11:13:01 server2 Device: Script Completed Successfully: hostname2
May 19 17:09:21 server3 Device: Script Completed Successfully: hostname3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use Field Extractor and then choose Regex and highlight the hostname part after selecting a sample event from your search.
Also same can be achieved by delimiter method and then you can remove unwanted extractions and can only keep hostname extraction i.e. after 4th semicolon as you have mentioned.
Regex will suit you best here.
For more information refer this link
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/FXSelectSamplestep
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This could be one of the easiest regular expression, however there are multiple options.
your base search
| rex field=_raw "Script Completed Successfully: (?<hostname>.*)"
| table hostname _raw
Once you have tested the Regular Expression you should move the same to Field Extractions using props.conf.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use Field Extractor and then choose Regex and highlight the hostname part after selecting a sample event from your search.
Also same can be achieved by delimiter method and then you can remove unwanted extractions and can only keep hostname extraction i.e. after 4th semicolon as you have mentioned.
Regex will suit you best here.
For more information refer this link
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/FXSelectSamplestep
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
