Hi All, Need a small help in the regex, I am able to match the host name but unable to over write to the host field in the selected field in splunk, using the below regex. Could you please guide in correcting the regex. Regex: index=firewall sourcetype="network:log" |rex field=_raw (? )(?<=Client_VPN,)\b[(\w)]+\b | table host host_name Event Details: Feb 16 23:54:02 test01.xxxx.com 1,2018/02/16 23:54:02,012501001035,6477528014920876411,0x8000000000000000,USERID,logout,473,2018/02/16 23:53:46,36,0,0,0,Client_VPN,node01fw,3,vsys3,10.X.X.X,ddesa0002,,0,1,0,0,0,vpn-client,globalprotect,0,0,,2018/02/16 23:53:47,1 Actual Requirement: Need to over write the host field value with the host_name field value from the interesting field. host=test01.xxxx.com host_name=node02fw Kindly guide me on the regex to over write the host value with the host_name value. ... View more

Hi All, Need a help in regex for doing the host over ride with dvc_host field value from the interesting fields for a firewall based on the sourcetype. 1) For the first source type paloalto:network:traffic, I am getting the below events details index=firewall sourcetype="paloalto:network:traffic" Event details: Feb 15 10:21:12 test01pano.xxxxxx.com 1,2018/02/15 10:21:12,012501001041,TRAFFIC,end,1,2018/02/15 10:21:11,10.x.x.x,10.x.x.x,0.0.0.0,0.0.0.0,Foundation Services,,,dns,vsys2,Data-Center-Admin,Data-Center-Core,ae5.2005,ae5.250,pan_log_forward,2018/02/15 10:21:11,667736,1,50811,53,0,0,0x19,udp,allow,xxx,xx,1xx,2,2018/02/15 10:20:42,0,any,0,6477528057945424450,0x8000000000000000,10.0.0.0-10.x.x.x,10.0.0.0-10.x.x.x,0,1,1,aged-out,17,0,0,0,Data_Center,east01fw,from-policy,,,0,,0,,N/A Requirement: We want to overwrite the "host" field for firewall logs to use to value for the "dvc_host" field host=test01pano.xxxxxx.com should be replaced with the dvc_host value=deast01fw I had tried this query but it is throwing Error: index=firewall sourcetype="paloalto:network:traffic" | rex field=_raw (?<host>\b[^(\.),]+\b(,)+\b(?=from-policy)\b) | table host dvc_host Error in 'SearchParser': Missing a search command before '^'. Error at position '89' of search query 'search index=firewall sourcetype="paloalto:networ...{snipped} {errorcontext = ?<host>\b[^(\.),]+\b(}'. But the regex is working fine when tested in the regex101.com , not sure where is the problem. 2) For the second sourcetype paloalto:network:sys, I am getting the below events: Event Details: Feb 15 10:45:14 test01pano.xxxxx.com 1,2018/02/15 10:45:14,000702503748,SYSTEM,general,0,2018/02/15 10:45:14,,general,,0,0,general,informational,"Connection to Update server: updates.paloaltonetworks.com completed successfully, initiated by 10.x.x.x",139387,0x0,0,0,0,0,,east01pano Requirement: We want overwrite the "host" field for logs to use to value for the "dvc_host" field. host=test01pano.xxxxxx.com should be replaced with the dvc_host value=east01pano Kindly guide me in creating the a regex which can over ride the host value to the value of dvc_host field. ... View more