https://community.splunk.com/t5/Splunk-Search/How-to-apply-regex-to-a-field-in-lookup-file/m-p/340291#M100912 <P>Assuming you just want to manipulate the result of the search <CODE>| inputlookup ABCD.csv</CODE>, try like this</P> <PRE><CODE>| inputlookup ABCD.csv | eval Host=mvindex(split(Host,"."),0) </CODE></PRE> <P>OR</P> <PRE><CODE>| inputlookup ABCD.csv | rex field=Host "^(?&lt;Host&gt;[^\.]+)" </CODE></PRE> Tue, 31 Oct 2017 20:55:53 GMT somesoni2 2017-10-31T20:55:53Z https://community.splunk.com/t5/Splunk-Search/How-to-apply-regex-to-a-field-in-lookup-file/m-p/340290#M100911 <P>I have a lookup file query as follows </P> <P>| inputlookup ABCD.csv which displays the results as follows </P> <P><STRONG>Host</STRONG><BR /><BR /> efgh<BR /> ijkl.mno.com<BR /> pqrs.tuv.net<BR /> wxyz</P> <P>Now how can i add a regex to display only the hostname and avoid the extra string which ever after the dot(.). I just want to apply the regex to display the result as follows </P> <P><STRONG>Host</STRONG><BR /><BR /> efgh<BR /> ijkl<BR /> pqrs<BR /> wxyz</P> Tue, 31 Oct 2017 20:49:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-apply-regex-to-a-field-in-lookup-file/m-p/340290#M100911 pavanae 2017-10-31T20:49:35Z https://community.splunk.com/t5/Splunk-Search/How-to-apply-regex-to-a-field-in-lookup-file/m-p/340291#M100912 <P>Assuming you just want to manipulate the result of the search <CODE>| inputlookup ABCD.csv</CODE>, try like this</P> <PRE><CODE>| inputlookup ABCD.csv | eval Host=mvindex(split(Host,"."),0) </CODE></PRE> <P>OR</P> <PRE><CODE>| inputlookup ABCD.csv | rex field=Host "^(?&lt;Host&gt;[^\.]+)" </CODE></PRE> Tue, 31 Oct 2017 20:55:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-apply-regex-to-a-field-in-lookup-file/m-p/340291#M100912 somesoni2 2017-10-31T20:55:53Z