I've got these logs from a number of sources that have inconsistent filenames - here are some examples:
AA000-77-100.100.100.100_abc__09348450.log
AA_000_100.200.100.100__abc__9038509485.log
100.210.100.100_abc__983475984759.log
AA000-110.200.100.110_abc__98234793437.log
AA0000-100.220.100.100_abc__9283492349.log
[monitor:///opt/splunk/var/log/test]
host_regex=.*[_-]+(?< host >\d+\.\d+\.\d+\.\d+)
(no spaces around "host", but it won't display unless I put them there)
Here is the regex that I got to work with your data:
[-_]?(?<host>\d+\.\d+\.\d+\.\d+)_+\w+
Now let's analyze your regex and why it was not working. As a general rule you want to avoid using ".*" because it is too greedy. So I removed that and also I replaced the "+" with a "?". The "+" means 1 or more while the "?" means 0 or more because sometimes there isn't any dash or underscore in the name. Another general rule is to work backwards sometimes that is why I ended with an underscore "+" and a \w+.
Hope this helps.
Here is the regex that I got to work with your data:
[-_]?(?<host>\d+\.\d+\.\d+\.\d+)_+\w+
Now let's analyze your regex and why it was not working. As a general rule you want to avoid using ".*" because it is too greedy. So I removed that and also I replaced the "+" with a "?". The "+" means 1 or more while the "?" means 0 or more because sometimes there isn't any dash or underscore in the name. Another general rule is to work backwards sometimes that is why I ended with an underscore "+" and a \w+.
Hope this helps.
That did it. Tested and I'm now pulling out the IP. Many thanks.
"?" means 0 or 1 (greedily)