About aswin_asok

aswin_asok · ‎11-20-2020

Hi, In addition to the query like this (2)35(2)48(3)199(3)157(7)in-addr(4)arpa(0), the logs are followed by UDP Response and many lines.. Ex. ] A (2)35(2)48(3)199(3)157(7)in-addr(4)arpa(0) UDP Response...... When I used - SEDCMD-win_dns = s/$\d+$/./g s/\s\.(.*)\.$/ \1/g the log is formatted as ] A .35.48.199.157.in-addr.arpa. There is a 'dot' at the end. Can you please advise on how to remove the trailing dot alone

aswin_asok · ‎12-09-2019

Hi @gcusello Have tried the below, | rex max_match=0 "assignment_group\s*=\s*(?\s[^OR)]+)"

aswin_asok · ‎12-08-2019

Many Thanks @woodcock , extraction is working as expected expect if there is a white space between the values.. included am additional \s. | rex max_match=0 "assignment_group\s*=\s*(?\s[^OR)]+)"

aswin_asok · ‎12-06-2019

i, One of my value in table is being passed as an Boolean expression as below (assignment_group = 1213App_Development1 OR assignment_group = App-Testing OR assignment_group = App Support OR assignment_group = App:Support OR assignment_group = App&$+*Support assignment_group = AppSupport) I'm trying to use the | makemv tokenizer= to make the above to be extracted as multivalues as below 1213App_Developmen1 App-Testing App Support App:Support App&$+*Support AppSupport And then use mxexpand to appy other table values to the expanded fields. Can anyone help me with the Regex to do so.

aswin_asok · ‎12-06-2019

Hi, One of my value in table is being passed as an Boolean expression as below (assignment_group = 1213App_Development1 OR assignment_group = App-Testing OR assignment_group = App Support OR assignment_group = App:Support OR assignment_group = App&$+*Support assignment_group = AppSupport) I'm trying to use the | makemv tokenizer= to make the above to be extracted as multivalues as below 1213App_Developmen1 App-Testing App Support App:Support App&$+*Support AppSupport And then use mxexpand to appy other table values to the expanded fields. Can anyone help me with the Regex to do so.

Posts	5
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎12-03-2019

Online Status	Offline
Date Last Visited	‎09-27-2021 05:14 AM

makemv command with tokenizer

Regular Expression to extract the below values

Re: Unable to parse dns windows logs in splunk

Re: Regular Expression to extract the below values

Re: Regular Expression to extract the below values

makemv command with tokenizer

Regular Expression to extract the below values