The log entry I have has:
Message=DNS query is completed for the name my.big.server.name.com, type 28, query options 1073897472 with status 0 Results ::ffff:10.2.1.20
How can I extract both the Named Address and IP Address into one Extracted Field with the value:
my.big.server.name.com (10.2.1.20)
The UI gives me an option to provide my own regex, but it clips the text:
DNS query is completed for the name (?P <dns_lookup>[^\, type]+)
@justdan23
You can use the rex commands and get final output by concatenating .
<your query>| rex field=_raw "\s+(?<domain>\w+\.\w+\.\w+\.\w+\.\w+)"| rex field=_raw "\S+:(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"| eval fname=domain+" "+ip
Note: The code block in this interface adds the numbers when trying to block a data sample.
Is there a better way for me to format this?
The Preview doesn't show the numbers before I posted it.