Splunk Search

How can I extract a value from a field that have many content

lllidan
New Member

I have a field named "Message", the content as below:

*Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.

Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.

You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.

Alternate server name:
AAABB0001
Failing DNS host name:*

I want to extract value "AAABB0001", I tried to use eval n=mvfind(Message,"\w{5}\d{4}"), but it only return a value "0".

Could you please give some better solution for me? thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval message="Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.


Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.


You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.


Alternate server name:
AAABB0001
Failing DNS host name:" |rex field=message "Alternate server name:\n+(?P<servername>\w+)"

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval message="Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.


Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.


You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.


Alternate server name:
AAABB0001
Failing DNS host name:" |rex field=message "Alternate server name:\n+(?P<servername>\w+)"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...