topic Re: Truncate characters after a specific character using the Trim function in Splunk Search

Truncate characters after a specific character using the Trim function

ASplunkDummy — Mon, 03 Jan 2022 16:37:28 GMT

Dear all, best wishes for 2022.

Is it possible to use rtrim to remove all characters out of a search result that come after a specific character? For example, using a FQDN, is it possible to use rtrim to remove every character after the host name (so after the dot)?

Original output: server1.domain.com

Desired output: server1

I am aware that regex can solve this, but I am looking for alternative options to solve this problem. This solution should ideally be working for any combination of servers and domain names.

Any help is welcome.

Re: Truncate characters after a specific character using the Trim function

richgalloway — Mon, 03 Jan 2022 18:53:34 GMT

The rtrim function cannot do what you seek reliably. You would have to give all characters as those to be trimmed and then you'd have nothing left. rtrim doesn't have a concept trim-up-to-this-point.

If you don't want to use rex then how about replace()?

Re: Truncate characters after a specific character using the Trim function

ASplunkDummy — Mon, 03 Jan 2022 23:58:02 GMT

Thanks for your suggestion. I tried this:

| eval ComputerName=replace(ComputerName, "^.*","([^\.]+)[\.].+")

This should look for any value in FQDN format and replace it with only the server name (every character before the first dot). It does replace the value of ComputerName, but it replaces it with the literal text. It ignores the fact the second part is also a regular expression. I am lost here. What do I miss?

Re: Truncate characters after a specific character using the Trim function

richgalloway — Tue, 04 Jan 2022 01:17:14 GMT

The replace function takes a regex only in the second argument. The other two arguments are literal strings (or fields).

To replace a regex with another regex, use the rex command with the sed option.

| rex mode=sed field=ComputerName "s/^.*/([^\.]+)[\.].+/"