I am trying to use rex to extract the hostnames and put them in a table, but rex is only matching the first string and then it stops
rex "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name
The data is part of a job log I am ingesting files and directories input.
The textfile is formatted like this:
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.mrcl1.domain.net (10.140.255.7):
ERROR: Cannot download Running config : Connection Refused by 10.140.255.7
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.abvl1.domain.net (10.252.255.50):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.blvw1.domain.net (10.196.255.5):
downloaded Running config
__________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.clem1.domain.net (10.196.255.1):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.domain.net (10.140.255.9):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.drck1.domain.net (10.132.255.3):
downloaded Running config
___________________________________________________________________________
I did have to clean this file up with python before getting it into splunk, so if some kind of text operation/reorganization would help this go more smoothly that is definitely an option.
The rex command by default matches only one. Use max_matchoption to increase that limit
...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name
The rex command by default matches only one. Use max_matchoption to increase that limit
...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name