Sorry, I don't use Splunk much so I am sure this is an easy search for you all.
I am trying to get a complete list of domains that I am currently pulling data from. I got as far as this index=apache | dedup host which as a list of hosts. Now I just want the domain portion of it.
The hostname is always 12 characters long. So I am hoping there is just a way count 13 characters from the left of the host name and then dedup on the results of the domain and sort.
But I am lost on how to go at that.
I hope I understand your question.
Here are a couple of approaches :
using: rex
rex field=host "(?i)(?[^\s])(?:(.com)|(.net))"
Using substring:
index=apache | dedup host | eval nhost = substr(host, 1,13 ) | ...
Additional Reading:
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/rex
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions