Splunk Search

How can I extract a value from a field that have many content

lllidan
New Member

I have a field named "Message", the content as below:

*Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.

Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.

You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.

Alternate server name:
AAABB0001
Failing DNS host name:*

I want to extract value "AAABB0001", I tried to use eval n=mvfind(Message,"\w{5}\d{4}"), but it only return a value "0".

Could you please give some better solution for me? thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval message="Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.


Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.


You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.


Alternate server name:
AAABB0001
Failing DNS host name:" |rex field=message "Alternate server name:\n+(?P<servername>\w+)"

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval message="Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.


Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.


You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.


Alternate server name:
AAABB0001
Failing DNS host name:" |rex field=message "Alternate server name:\n+(?P<servername>\w+)"
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...