UNIX for Dummies Questions & Answers

I am looking for the proper regex to match the hostname "areagc11" of this log.... Any help would be awsome

Oct 25 11:08:18 areagc11 961: Oct 25 18:08:17.536 GMT: %SYS-5-CONFIG_I: Configured from console by someone onvty1 (10.156.72.97)

Where's the hostname? And if you say that it's "X", I'll say why not just use the string "X" to match?
Seriously, you should provide more info, may be more of that log to show those lines which need to be filtered out and those which need to be retained, the logic behind that, etc.

hostname:
areagc11

log:
Oct 25 11:08:18 areagc11 961: Oct 25 18:08:17.536 GMT: %SYS-5-CONFIG_I: Configured from console by someone onvty1 (10.156.72.97)

I'm not sure what exactly is your requirement, but if you simply want to retrieve a line in your log file which has host name: areagc11 in it, then you can use grep command:

Code:

grep areagc11 <log file name>

Sorry guys for not being clear, I am using Splunk which is a logging tool. It parses out parts of the log for you and even grabs the hostname. For some reason these cisco logs are not grabbing the correct hostname. I am currently ussing the following to match the hostname but it is not picking it up correctly.

REGEX = \w+\s+\w+\s+\w+\:\w+\:\w+\s+((\w+\.\w+\.\w+\.\w+)|((\w+)(\-)*(\w+)*))\s+\w+\:\s+(\w+)
FORMAT = host::$1

From:
Oct 25 11:08:18 areagc11 961: Oct 25 18:08:17.536 GMT: %SYS-5-CONFIG_I: Configured from console by someone onvty1 (10.156.72.97)

I wanted to see if someone would have a better idea for a pattern to match the hostname areagc11 which is just 1 name out of 10,000 routers so I can't use any part of the hostname to match on.

To be honest, this is not the normal regexp, but probably some internal regexp from Splunk. How this works i don't know (i haven't heard of this program until now), but from what i think i can understand the problem seems to be the part marked bold here:


You seem to search for 4 words, separated by 3 dots. This might resemble a hostname like "host.some.sub.domain", but you have only a short name there and your regexp doesn't match therefore.

Make all but the first word to be optional, which probably looks like this:

Code:

REGEX = \w+\s+\w+\s+\w+\:\w+\:\w+\s+((\w+\.*\w+*\.*\w+*\.*\w+*)|((\w+)(\-)*(\w+)*))\s+\w+\:\s+(\w+)
FORMAT = host::$1

I hope this helps.

bakunin

Thanks big time I will give it a try.

---------- Post updated 10-31-12 at 09:02 AM ---------- Previous update was 10-30-12 at 10:39 AM ----------

FYI, the code did not work for me but I figured it out and used the following code.

(?i)^(?:[^ ]* ){3}(?P<FIELDNAME>[^ ]+)