topic Re: How do I edit my regex to capture the shortname from a mix of FQDN and shortname host field entries? in Splunk Search

How do I edit my regex to capture the shortname from a mix of FQDN and shortname host field entries?

renems — Thu, 19 Nov 2015 21:15:26 GMT

I'm trying to create a new field based on the host field. The new field (hostname) should only contain the shortname. The host field is currently a mix of fqdn and shortnames:

server1.linux.splunk.co.uk
server2.linux.splunk.co.uk
server3
server4.linux.splunk.co.uk

So far, this comes close to what I'm trying to achieve:

| rex field=host "(?P<hostname>[^ ]+?)\."

Works great for all entries that actually do have a dot (.) in the text (number1, 2, 4). The ones without a dot (.) return blank. How do I also include the ones that don't need modification at all? (number 3)

Any help greatly appreciated!

Re: How do I edit my regex to capture the shortname from a mix of FQDN and shortname host field entries?

ltrand — Thu, 19 Nov 2015 21:23:50 GMT

It's too greedy to put against just a block of text, but as long as the field is sanitary, this should work:

(?P<hostname>[^.]+)

Re: How do I edit my regex to capture the shortname from a mix of FQDN and shortname host field entries?

renems — Thu, 19 Nov 2015 21:28:20 GMT

It does! Kudo's for you, my friend!