Splunk Search

rex to modify hostname field and where . is there remove it

surekhasplunk
Communicator

I have index=syslog where the hostname comes as fqdn and Ip address

i want rex to modify only hostname field only where fqdn is coming and modify then to get only first part of the hostname all after . should be removed and save it in a new field host. 

example : hostname column has hostname which looks like abcd-efg-hij-k23-b1.xyz.gmail

Now after using rex/sed i want in the host field abcd-efg-hij-k23-b1 everything after . should be removed. 

note: i also have ip address which has . in it so while applying rex the ip addresses should not be considered.

It should only affect/take into consideration the alphanumeric field. 

Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

let me understand: do you want a regex to extract the hostname before dot at search time or do you want to set the hostname at indextime?

If at searchtime, try this regex

| rex field=host "^(?<host>[^\.]+)"

if you want to replace the hostname using SEDCMD, you could try:

SEDCMD-host = y/[^\.]\.\w+\.\w+/[^\.]/

Ciao.

Giuseppe

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sumandevops,

You can use rex command;

| rex field=host "(?<host_no>\d+)"
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

let me understand: do you want a regex to extract the hostname before dot at search time or do you want to set the hostname at indextime?

If at searchtime, try this regex

| rex field=host "^(?<host>[^\.]+)"

if you want to replace the hostname using SEDCMD, you could try:

SEDCMD-host = y/[^\.]\.\w+\.\w+/[^\.]/

Ciao.

Giuseppe

0 Karma

sumandevops
Engager

How to get first part before . 

 

example: host filed is looks like 

abdc.4567

I want only 4567

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...