Splunk Search

How can i search for a host wich must have 3 letters at the begin of the dns name ?

criedman
Explorer

Hi,

i want to search for hosts which always have 3 letters at the begin of the dns name.

search:

index="myindex" host="(letter)(letter)(letter)server*"

Result should be:

xxxserver01
aaaserver01
bbbserver01
cccserver01
....

Thanks!
Christoph

Tags (1)
0 Karma
1 Solution

wenthold
Communicator

You could use regex:

index="myindex" | regex host="^[a-zA-Z]{3}server"

Depending upon what's in "myindex" this is a pretty expensive search, if you can narrow down the results processed by "| regex ..." in any way you should.

View solution in original post

wenthold
Communicator

You could use regex:

index="myindex" | regex host="^[a-zA-Z]{3}server"

Depending upon what's in "myindex" this is a pretty expensive search, if you can narrow down the results processed by "| regex ..." in any way you should.

somesoni2
SplunkTrust
SplunkTrust

The regex command expects full regular expression representation of the values of the field, so you would want to add a .+ at the end after server to incorporate those numbers at the end of host names.

0 Karma

wenthold
Communicator

I ran a test search on 6.5.5 without doing the full field match and it worked, and I don't see that requirement in the search manual:

search reference - regex

Am I missing something?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Actually I take that back. I can swear it didn't work for me in some version. May be my memory needs updates.

0 Karma

HiroshiSatoh
Champion

index="myindex" host="server"|where match(source, "^[a-zA-Z]{3}server.*")

0 Karma

criedman
Explorer

Hi,

thank you thats the perfect solution for me =).

| where match(source, "^[a-zA-Z]{3}server.*")

Result:
The result must contain 3 letters before "server".

xxxserveryyy

Thanks
Christoph

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...