Hi,
I'm new to Splunk so hope:
1) I'm not asking a stupid question
2) someone can help
Anyway, I want to extract a hostname and user name from a "source" at search time.
I know I need to "| rex field=source" but can't figure out the syntax as yet.
the source I have is in the following format:
/export/Data/History/servername_user
Kind Regards
Mario
I'd probably use:
rex field=source "(?i)\/export\/data\/history\/(?P
Splitting out both host and user
Thank you both for your help (so far).
I was hoping to use the hostname and user in a table, would that be possible considering that these variables are not permanent?
rex field=source "(?i)\/export\/data\/history\/(?P<hostName>\w+)\_user"
I believe should do it..
You can also use the IFX (Interactive Field Extractor) to help with you extractions/regex.
http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/ExtractfieldsinteractivelywithIFX
Note, that rex will not make a permanent field, only one that exists in the context of the present search string.
This reference is pretty good for regex
http://www.regular-expressions.info/reference.html
Regards,
Matt