Getting Data In

Need help rewriting DNS log lines

the_wolverine
Champion

I have DNS log lines that look like the following:

(4)mail(6)google(3)com(0)
(7)twitter(3)com(0)
(12)spreadsheets(1)l(6)google(3)com(0)

How would I configure rewriting so that Splunk will display them in a more appealing format?

mail.google.com
twitter.com
spreadsheets.l.google.com
Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Can you use rex's sed mode? This may be a little too indiscriminate, but:

blah | rex mode=sed "s/\(\d\)/\./g"

View solution in original post

the_wolverine
Champion
props.conf

[dns]
SEDCMD-dns = s/\(\d\)/\./g s/\(\d\d\)/\./g

* Splunk didn't seem to like \d? so I used \d\d for the cases where we have 2 digits: (12)
0 Karma

the_wolverine
Champion

Ah ok, thanks for that. I can streamline that REGEX now 🙂

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You need \d+, not \d?. \d? means zero or one digit. If there are never more than two, you can use \d{1,2}

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Can you use rex's sed mode? This may be a little too indiscriminate, but:

blah | rex mode=sed "s/\(\d\)/\./g"

the_wolverine
Champion

Thank you! It seems you don't need the escape for '.' for some reason -- Ultimately, I will use sedcmd to do this.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...