Splunk Search

regex help

surekhasplunk
Communicator

Hi,

My sample code looks like below :

Mon Mar  9 14:18:14 2020: Unknown trap (.1.1.1.1.1..1) received from hostname.abcd.com at: 
Value 0: hostname.abcd.com
Value 1: 1.2.3.4
Value 2: 11.22.33.44

Another sample value is 

Mon Mar  9 13:38:23 2020: Unknown trap (.1.2.3.4.5.6) received from 19.19.19.19 at: 
Value 0: 19.19.19.19
Value 1: 4.4.4.4.4
Value 2: 12.13.14.15

Value 0: give me either the IP or the hostname .
I need to extract field called machine_name with the value of Value 0:

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,
try this:

(?ms)Value\s+0:\s+(?<value0>[^ ]+)Value

that you can test at https://regex101.com/r/SlYtf3/1

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,
try this:

(?ms)Value\s+0:\s+(?<value0>[^ ]+)Value

that you can test at https://regex101.com/r/SlYtf3/1

Ciao.
Giuseppe

0 Karma

surekhasplunk
Communicator

Thanks @gcusello It worked 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

You're welcome!
Ciao and next time.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...