Splunk (perl) REGEX for DNS

StackOverflow https://stackoverflow.com/questions/9526474

  •  15-11-2019
  •  | 
  •  

Question

Im trying to create a regex to pull out the CNAME for DNS quires in splunk. I can get the first DNS name (everything after "CNAME-record for " and before ( "=" ), but i cant find an expression to get the next DNS name after the equals. 

Mar  1 09:16:43 123.dns.local Mar  1 09:16:43 dns-01-1 SDNS: -> Answer: CNAME-record for dl.wu.ms.edgesuite.net = a26.ms.akamai.net
Mar  1 09:16:43 123.dns.local Mar  1 09:16:43 dns-01-1 SDNS: -> Answer: CNAME-record for dom.dl.wu.akadns.net = dl.wu.ms.edgesuite.net
Mar  1 09:16:43 123.dns.local Mar  1 09:16:43 dns-01-1 SDNS: -> Answer: CNAME-record for main.dl.wu.akadns.net = dom.dl.wu.akadns.net
Mar  1 09:16:43 123.dns.local Mar  1 09:16:43 dns-01-1 SDNS: -> Answer: CNAME-record for download.windowsupdate.nsatc.net = main.dl.wu.akadns.net
Mar  1 09:16:43 123.dns.local Mar  1 09:16:43 dns-01-1 SDNS: -> Answer: CNAME-record for download.windowsupdate.com = download.windowsupdate.nsatc.net
Mar  1 09:16:43 123.dns.local Mar  1 09:16:43 dns-01-1 SDNS: -> Answer: CNAME-record for dl.wu.ms.edgesuite.net = a26.ms.akamai.net
Was it helpful?

Solution

Use the = in the data and the end-of-string anchor to add the needed structure:

/CNAME-record\sfor\s(.*?)\s*=\s*(.*)$/

OTHER TIPS

If there are some info after the second DNS, use this one:

/CNAME-record\sfor\s(\S+)\s*=\s*(\S+)/

where \S+ means one or more non-space character.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top