topic Re: How to change each instance of a field search result in Splunk Search

How to change each instance of a field search result?

atebysandwich — Thu, 26 Jan 2023 19:24:08 GMT

I'm doing a search for server names and will eventually extract to to a csv. However, each result comes out as one of the following

servername.domain: servername.domain
servername: servername.domain
servername: servername

How can I change the results in that particular field to be just servername? I feel like this is where regular expressions may come in to play.

Re: How to change each instance of a field search result

ITWhisperer — Thu, 26 Jan 2023 14:36:26 GMT

Try something like this

| rex field=particular "\w+:(?<servername>\w+)\.)"

Re: How to change each instance of a field search result

atebysandwich — Thu, 26 Jan 2023 14:43:09 GMT

Unfortunately that didn't work. The field results still come out the same. But I noticed they come out in a few different ways:

servername.domain: servername.domain
servername: servername.domain
servername: servername

Re: How to change each instance of a field search result

ITWhisperer — Thu, 26 Jan 2023 15:18:34 GMT

Please share some sample events in a code block </> since normal pasting can alter the (white-space) formatting.

Re: How to change each instance of a field search result

atebysandwich — Fri, 27 Jan 2023 19:33:41 GMT

I was able to figure out the issue without regex - I was looking at the wrong field. Thank you for the help,