regex help!

[kiran331]

How to extract the IP OR hostname from the field "source"?

source=/opt/var/log/splunk/ciscoasa/11.12.22.345/2017_06_05_21_cisco.log
source=/opt/var/log/splunk/ciscoasa/abc_xyz/2017_06_05_21_cisco.log

I need to extract 11.12.22.345 & abc_xyz

[horsefez]

Hi,

because I was bored I made this redundant answer.

yoursearch | rex field=source "(?<host>[^\/]+)\/[^\/]+(?:$)"

[gcusello]

Hi kiran331,
Try this:

your_search | rex field=source "ciscoasa\/(?<host>[^\/]*)" | ...

you can test it at https://regex101.com/r/wrL9Ze/1

Bye.
giuseppe

[inventsekar · Accepted solution]

Hi Kiran, Verified and this works fine -

source="ciscoasa.txt" | rex field=_raw "ciscoasa\/(?<ipAddress>.*)\/" | table ipAddress _raw