How to extract the IP OR hostname from the field "source"?
source=/opt/var/log/splunk/ciscoasa/11.12.22.345/2017_06_05_21_cisco.log
source=/opt/var/log/splunk/ciscoasa/abc_xyz/2017_06_05_21_cisco.log
I need to extract 11.12.22.345 & abc_xyz
Hi Kiran, Verified and this works fine -
source="ciscoasa.txt" | rex field=_raw "ciscoasa\/(?<ipAddress>.*)\/" | table ipAddress _raw
Hi,
because I was bored I made this redundant answer.
yoursearch | rex field=source "(?<host>[^\/]+)\/[^\/]+(?:$)"
Hi kiran331,
Try this:
your_search | rex field=source "ciscoasa\/(?<host>[^\/]*)" | ...
you can test it at https://regex101.com/r/wrL9Ze/1
Bye.
giuseppe
Hi Kiran, Verified and this works fine -
source="ciscoasa.txt" | rex field=_raw "ciscoasa\/(?<ipAddress>.*)\/" | table ipAddress _raw