Splunk Search

rex command help...

Hi All,

my data is like below-- I want to extract when it has string ignore numbers

853727-gcplusrspcndb01.usa.corp.ad
10.198.29.5

Output:-

853727-gcplusrspcndb01
 10.198.29.5
0 Karma

SplunkTrust
SplunkTrust
| rex mode=sed "s/[.a-z]*$//"
0 Karma

SplunkTrust
SplunkTrust

Hi @harishalipaka,
try this

| rex "^\s+(?<url>[^\.]+).*\s+(?<ip>\d+\.\d+\.\d+\.\d+)"

that you can test at https://regex101.com/r/6axOMx/1

Ciao.
Giuseppe

0 Karma

Hi @gcusello

It is not working for me .am getting empty fields.

| rex field=HostName "^\s+(?<url>[^\.]+).*\s+(?<ip>\d+\.\d+\.\d+\.\d+)"
0 Karma

SplunkTrust
SplunkTrust

Hi @harishalipaka,
probably your row data are different, this regex is related to the information you shared, could you share an example of your row data?

Ciao.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

Here's one way.

... | rex "(?<field>[^\.]+)"
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Hi @richgalloway

I already tried this logic but it will extract like below

853727-gcplusrspcndb01
10

But i want like this

853727-gcplusrspcndb01
  10.198.29.5
0 Karma