I did use the field extractor in Splunk 3, but haven’t tried it in Splunk 4 yet. In Splunk 3 it was easier for me to just write the regex because there were instances where I couldn’t get it to pick up a specific value in my Windows 2008 events. I’ll have to try it out and version 4, it will be nice if I can manually modify and test the regex it generates. I agree that the regex in my example is somewhat difficult. I need it to capture IP addresses and ignore prefixes (like www and subdomain names) but still capture domain suffixes (like .com and .ab.ca) so that is where most of the complexity comes in. I’m positive there are other, more simplified, regexes that will do the same job. As the old saying goes… there’s more than one way to skin a cat.

Thanks for the tip! I’m going to go check out the field extractor.

But that same tool allows you to edit the regex right there and fix it up, so you can see how it extracted in your data on hundreds of examples, or tens of thousands if you hit the ‘test’ button.