Hi,
I am new to splunk and regex, sorry for poor knowledge.
I am trying to extract hostname from
/var/log/syslog/2013/11/14/hostname_messages.log
So far I came up with [a-zA-Z]*([^]+).log$ but this result has _messages.log.
How Can I get rid of this part?
.+/(?<hostname>.+?)\_
No problem. Please check the checkmark next to this post to accept the answer. Thanks!
This works like a charm!!
So this is using
Thanks a lot!
This should work for you. This takes anything between last "/" and "_".
".*/(?<host>[^_]+)"
How about:
/([a-zA-Z0-9]+)_messages\.log
Assuming that 'hostname' only contains alpha-numeric characters.
Or, if your 'hostname' doesn't include underscores:
/([^_/]+)_messages\.log
You need to 'escape' the period character, as it has a special meaning in regex.
Are you trying to extract the hostname as part of an input, in inputs.conf or are you trying the use the 'rex' command in the Search App?