I have a field "hostname" in splunk logs which is available in my event as "host = server.region.ab1dc2.mydomain.com".
I can refer to host with same name "host" in splunk query. I want to extract the substring with 4 digits after two dots ,for the above example , it will be "ab1d". How my splunk query should look like for this extraction?
Basically I have been given a string, and want to skip two dots and then take the four characters after that.
1 Answer
So long as you have at least three segments to a fully-qualified domain name, this should work (without using a regular expression)
index=ndx sourcetype=srctp host=* | makemv delim="." host | eval piece=substr(mvindex(host,3),1,4) ... makemv converts a field into a multivalue field based on the delim you instruct it to use
Then use eval to grab the third item in the list using mvindex, trimming it with substr
If you really want to use a regular expression, this will do it (again, presuming you have at least three pieces to the FQDN):
index=ndx sourcetype=srctp host=* | rex field=host "\.[^\.]+\.(?<piece>[^\.]{4})" ... 
