Splunk Search

Extracting selected hosts with regex / Regex hosts with exceptions

lemikg
Communicator

Hi Splunkers,

I am trying to extract the hosts via regex.

host="*" | regex host="([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}" | dedup host | table host | sort -host

The problem is that some hosts have a name and some of them come with the full domain name.

For example:

host
xd-test-app05.abc-xz.com
xd-test-app04.abc-xz.com
xd-test-app03
xd-test-app03.abc-xz.com
xd-test-app02
xd-test-app02.abc-xz.com
xd-test-app01.abc-xz.com
xd-shared-db01.abc-xz.com
xd-qa-app08.abc-xz.com

Is there a way to add an exception to my regex?

Thanks in advance for your help.

regards
Mike

1 Solution

jonuwz
Influencer

If they're all from the same domain

host="*" | rex field=host "^(?<host>[^.]+)" | dedup host | table host | sort -host

View solution in original post

jonuwz
Influencer

If they're all from the same domain

host="*" | rex field=host "^(?<host>[^.]+)" | dedup host | table host | sort -host

martin_mueller
SplunkTrust
SplunkTrust

A lot of the expression was lost in the formatting, now (amongst other things) the period is escaped properly.

0 Karma

lemikg
Communicator

Hi, I can't answer the question regarding The "." in my capture group since I just copied that from an example. St this point I can't provide Any sourcedata since i am not in The office any more. But The source is nothing special Art all.

0 Karma

mikelanghorst
Motivator

What does the source data look like, are they all fqdn's? Why do you have . in your capture group, as that should match any character.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...