Hello
I'm trying to do a substr to strings such as:
google-public-dns-b.google.com
cachewas.tdp.net.pe
b.resolvers.Level3.net
And give me back the following:
google.com
tdp.net.pe
Level3.net
I thought doing a substr(domain,(mvjoin(domain,"."))
But it turned out, that way it could be achieved?
I would appreciate your support.
Regards
I'm assuming that you have a field for that FQDN called 'hostname'. If that is not the field name, use what is the field name. If you don't have a field for the FQDN pre-defined, then the answer would be different. This answer assumes you want two levels of the domain name (as in google.com):
... | rex field=hostname "\.(?<s_domainname>\S+\.\S+)$"
I'm assuming that you have a field for that FQDN called 'hostname'. If that is not the field name, use what is the field name. If you don't have a field for the FQDN pre-defined, then the answer would be different. This answer assumes you want two levels of the domain name (as in google.com):
... | rex field=hostname "\.(?<s_domainname>\S+\.\S+)$"
.co.uk 😞
I've thought about working on an app to build up the known TLDs in order to get a correct "domain" mapping, but I never got around to it.
old question, but i worked through a similar problem in
This question
Basically, you can use these to get at different subdomain levels
| rex field=dest_hostname "(?P<ld2>[\w_-]+\.[\w_-]+)$"
| rex field=dest_hostname "(?P<ld3>[\w_-]+\.[\w_-]+\.[\w_-]+)$"
| rex field=dest_hostname "(?P<ld4>[\w_-]+\.[\w_-]+\.[\w_-]+\.[\w_-]+)$"
It's very good.
Thank you very much.
How would you (and thus Splunk) know that the second domain is supposed to be transformed to "tdp.net.pe" and not just "net.pe"?