topic Re: Extract Field value in Reporting

Extract Field value

Zenun — Mon, 03 May 2021 20:40:24 GMT

Hello Splunker,

Since I am not computer science major, I have a hard time with Regex.

I have fields value with lxw0000.usr.osd.mil, amico0000, alsedx.osd.mil and so much more with variation.

How can I extract value before the first period?

for example just

Server

lxw0000

amico0000

alsedx

when I use the (?<server>.*).\ , it does not show the amico0000.

Your quick help will be appreciated.

Thanks.

ITWhisperer — Mon, 03 May 2021 21:13:08 GMT

It depends on what delimits your string - I have assumed either dot or space

| rex "^(?<server>[^\.\s]+)"

s2_splunk — Mon, 03 May 2021 21:52:02 GMT

| makeresults | eval n="lxw0000.usr.osd.mil,amico0000,alsedx.osd.mil" | makemv delim="," n | rex field="n" "^(?<host>\w+)\.?"

First three lines to generate your test dataset. Will extract anything before your first "." (which is optional)

Zenun — Tue, 04 May 2021 17:05:20 GMT

Thank you both for the quick solution. have a great day!