For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

LmenD's avatar
LmenD
Icon for Nimbostratus rankNimbostratus
Dec 13, 2018

F5 Analytics iApp - Mapping Regex

I'm trying to write a mapping regex for the F5 Analytics iApp (3.7.0). I'm struggling to find a regex combination that works with the naming convention used for the virtual servers.

Naming Convention

...vs

Example

app1.dev.443.vs

app1.dev.80.vs

app2.443.vs

I'm looking for a regex that will pare the virtual server name down to just the app name. Using regex101.com, I was able to verify this regex does what I want.

(.*?)\..*

When I add it to the mapping table of the iApp, Splunk returns zero results. It seems either the iApp or TMOS itself does not honor the ? as it should. If I omit the ?, the iApp returns everything up to and including the .v of .vs instead of stopping at the first . after the app name.

Does anyone have any regex suggestions to just return the app name?

No RepliesBe the first to reply