Hi all,
In certain search, Splunk returns DNS hostnames, for example:
a.monetate.net.akadns.net
evsecure-ocsp.verisign.com
To facilitate sorting, I'd like to have the names displayed in reverse order across the dots, e.g.:
net.akadns.net.monetate.a
com.verisign.evsecure-ocsp
I've found some examples that suggest how to change word order but Splunk rejects it during search:
sourcetype=dns | rex field=domain mode=sed "s/\n/!G;s/\(.\)\(.*\n\)/&\2\1/;//D;s/.//"
Yields: Error in 'rex' command: Failed to initialize sed. Invalid option string: (.)(.*\n)/&\2\1/;//D;s/.//
Ideas?
folkstalk [dot] com/2011/12/methods-to-reverse-string-using-unix.html
programmingforums [dot] org/post188712.html
I've not written it yet, but my plan to handle this is to write a dynamic lookup that does the equivalent of this (in perl):
$sortable_name=$hostname;
$sortable_name=~s{(\d+)}{sprintf "%09d", $1}g;
$sortable_name=join('.', reverse(split(/\./, $sortable_name)));
return $sortable_name;
So given a field with the hostname, it'd return a new field with a "sortable name." You could sort on that field, and then remove it from the results.