Splunk Search

rex to modify hostname field and where . is there remove it

surekhasplunk
Communicator

I have index=syslog where the hostname comes as fqdn and Ip address

i want rex to modify only hostname field only where fqdn is coming and modify then to get only first part of the hostname all after . should be removed and save it in a new field host. 

example : hostname column has hostname which looks like abcd-efg-hij-k23-b1.xyz.gmail

Now after using rex/sed i want in the host field abcd-efg-hij-k23-b1 everything after . should be removed. 

note: i also have ip address which has . in it so while applying rex the ip addresses should not be considered.

It should only affect/take into consideration the alphanumeric field. 

Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

let me understand: do you want a regex to extract the hostname before dot at search time or do you want to set the hostname at indextime?

If at searchtime, try this regex

| rex field=host "^(?<host>[^\.]+)"

if you want to replace the hostname using SEDCMD, you could try:

SEDCMD-host = y/[^\.]\.\w+\.\w+/[^\.]/

Ciao.

Giuseppe

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sumandevops,

You can use rex command;

| rex field=host "(?<host_no>\d+)"
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

let me understand: do you want a regex to extract the hostname before dot at search time or do you want to set the hostname at indextime?

If at searchtime, try this regex

| rex field=host "^(?<host>[^\.]+)"

if you want to replace the hostname using SEDCMD, you could try:

SEDCMD-host = y/[^\.]\.\w+\.\w+/[^\.]/

Ciao.

Giuseppe

0 Karma

sumandevops
Engager

How to get first part before . 

 

example: host filed is looks like 

abdc.4567

I want only 4567

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...