Our DNS server logs' date in the following format:
02.03.2016 13:57:08 027C PACKET 0220AFE8 UDP Snd 10.10.10.160 6f8b R Q [8081 DR NOERROR] A (5)nexus(10)officeapps(4)live(3)com(0)
02.03.2016 14:06:33 027C PACKET 02C0D668 UDP Snd 10.10.10.130 6fc3 R Q [8081 DR NOERROR] A (7)android(10)googleapis(3)com(0)
How do I use eval to get:
url=nexus.officeapps.live.com
url=android.googleapis.com
I have tried several regex to get out various groups, but url varies in length.
Try this:
your search here
| rex field=_raw "\[[^\]]+\]\s+A\s+\(\d+\)(?<url>\S+?)\(\d+\)$"
| rex mode=sed field=url max_match=0 "s/(\(\d+\))/./g"
Example:
| stats count
| eval event = " 02.03.2016 13:57:08 027C PACKET 0220AFE8 UDP Snd 10.10.10.160 6f8b R Q [8081 DR NOERROR] A (5)nexus(10)officeapps(4)live(3)com(0)"
| rex field=event "\[[^\]]+\]\s+A\s+\(\d+\)(?<url>\S+?)\(\d+\)$"
| rex mode=sed field=url max_match=0 "s/(\(\d+\))/./g"
Output: url = nexus.officeapps.live.com
Try this:
your search here
| rex field=_raw "\[[^\]]+\]\s+A\s+\(\d+\)(?<url>\S+?)\(\d+\)$"
| rex mode=sed field=url max_match=0 "s/(\(\d+\))/./g"
Example:
| stats count
| eval event = " 02.03.2016 13:57:08 027C PACKET 0220AFE8 UDP Snd 10.10.10.160 6f8b R Q [8081 DR NOERROR] A (5)nexus(10)officeapps(4)live(3)com(0)"
| rex field=event "\[[^\]]+\]\s+A\s+\(\d+\)(?<url>\S+?)\(\d+\)$"
| rex mode=sed field=url max_match=0 "s/(\(\d+\))/./g"
Output: url = nexus.officeapps.live.com
Works perfectly.
Follow up question. Can this be done in Props.conf? If so, how?
Yes, see this:
And look for the inline (via props.conf) or advanced (via props.conf and transforms.conf).