https://community.splunk.com/t5/Splunk-Search/How-to-drop-domain-from-results/m-p/533600#M150791 <P>Try&nbsp; eval src=replace(src,".mydomain.com","")</P> Fri, 18 Dec 2020 18:15:36 GMT saravanan90 2020-12-18T18:15:36Z https://community.splunk.com/t5/Splunk-Search/How-to-drop-domain-from-results/m-p/533599#M150790 <P>In splunk I have fully qualified sources and destinations. Example:<BR /><BR />src=host1.mydomain.com</P><P>When I table it out I just want it to show host1 without .mydomain.com</P><P>How do I do this?</P> Fri, 18 Dec 2020 18:06:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-drop-domain-from-results/m-p/533599#M150790 fdevera 2020-12-18T18:06:46Z https://community.splunk.com/t5/Splunk-Search/How-to-drop-domain-from-results/m-p/533600#M150791 <P>Try&nbsp; eval src=replace(src,".mydomain.com","")</P> Fri, 18 Dec 2020 18:15:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-drop-domain-from-results/m-p/533600#M150791 saravanan90 2020-12-18T18:15:36Z https://community.splunk.com/t5/Splunk-Search/How-to-drop-domain-from-results/m-p/533604#M150792 <P class="lia-align-left"><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/199592">@fdevera</a>&nbsp; You could use a regular expression to create a new field for the subdomain, then call that new field in your table.</P><LI-CODE lang="python">| rex field=src "(?&lt;justthesubdomain&gt;.+?(?=\.))" | table justthesubdomain</LI-CODE><P>&nbsp;</P> Fri, 18 Dec 2020 19:01:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-drop-domain-from-results/m-p/533604#M150792 efavreau 2020-12-18T19:01:58Z