Forum Discussion

LmenD's avatar
LmenD
Icon for Nimbostratus rankNimbostratus
Dec 13, 2018

F5 Analytics iApp - Mapping Regex

I'm trying to write a mapping regex for the F5 Analytics iApp (3.7.0). I'm struggling to find a regex combination that works with the naming convention used for the virtual servers.

Naming Convention

...vs

Example

app1.dev.443.vs

app1.dev.80.vs

app2.443.vs

I'm looking for a regex that will pare the virtual server name down to just the app name. Using regex101.com, I was able to verify this regex does what I want.

(.*?)\..*

When I add it to the mapping table of the iApp, Splunk returns zero results. It seems either the iApp or TMOS itself does not honor the ? as it should. If I omit the ?, the iApp returns everything up to and including the .v of .vs instead of stopping at the first . after the app name.

Does anyone have any regex suggestions to just return the app name?

No RepliesBe the first to reply