Hi @all,
i have following string which i want to break into there fields: service_name, host and port_id
metics-ha-5924590-011.aba.corp.tyos.com:2002
service_name = metics
host = ha-5924590-011.aba.corp.tyos.com
port = 2002
anyone please help me, how can i do it in splunk query.
Thanks !!
Hi @Khushboo,
you have to define a rule to extract fields:
if you cadn define that:
this regex can work.
In other words if you can define a rule, you can use a regex otherwise you cannot!
Ciao.
Giuseppe
Hi @Khushboo,
Please, try this regex:
| rex "(?<service_name>[^-]+)-(?<host>[^:]+):(?<port>\d+)"
tha you can test at https://regex101.com/r/wkUHCx/1
Ciao.
Giuseppe
Hi @gcusello ,
Thanks for your reply.
In my case all the variables like service_name, host and port are dynamic. so i cant hard-coded that.
Hi @Khushboo,
you have to define a rule to extract fields:
if you cadn define that:
this regex can work.
In other words if you can define a rule, you can use a regex otherwise you cannot!
Ciao.
Giuseppe