topic Re: How to use the mvindex command to remove all characters after the second period (.) for a field's values? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262948#M78926 <P>A simplistic replace might be ok for you - <BR /> | eval new_Asset_Name = replace(Asset_Name,".ews.int","")</P> Tue, 29 Sep 2020 09:15:38 GMT ddrillic 2020-09-29T09:15:38Z How to use the mvindex command to remove all characters after the second period (.) for a field's values? https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262944#M78922 <P>Hello,</P> <P>I am finding difficulty to use the mvindex command to remove all the characters after the second period (.). Below is the column name Asset_name which has those values:</P> <P>Asset_Name</P> <P>s.hal.ews.int<BR /> n2323paop-34.storage.ews.int</P> <P>I want the output to be:</P> <P>s7050qalv.hal<BR /> n2323paop-34.storage</P> Mon, 28 Mar 2016 19:44:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262944#M78922 vrmandadi 2016-03-28T19:44:19Z Re: How to use the mvindex command to remove all characters after the second period (.) for a field's values? https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262945#M78923 <P>I got it</P> <P>eval "Asset Names"=mvindex(split('Asset Names',".ews"),0) </P> Mon, 28 Mar 2016 20:02:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262945#M78923 vrmandadi 2016-03-28T20:02:27Z Re: How to use the mvindex command to remove all characters after the second period (.) for a field's values? https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262946#M78924 <P>What is your current query? Is your sample data a single event with two asset names or two events with one asset name each?</P> Mon, 28 Mar 2016 20:02:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262946#M78924 richgalloway 2016-03-28T20:02:54Z Re: How to use the mvindex command to remove all characters after the second period (.) for a field's values? https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262947#M78925 <P>Try this just all by itself:</P> <PRE><CODE>| gentimes start=-1 | eval Asset_Name="n2323paop-34.storage.ews.int" | eval "Asset Name"=replace(Asset_Name,"(.+)\.ews.*","\1") | table "Asset Name" Asset_Name </CODE></PRE> <P>The 1st line is for setup, the second does the work, and the third shows the two -- before and after.</P> Mon, 28 Mar 2016 22:28:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262947#M78925 wrangler2x 2016-03-28T22:28:28Z Re: How to use the mvindex command to remove all characters after the second period (.) for a field's values? https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262948#M78926 <P>A simplistic replace might be ok for you - <BR /> | eval new_Asset_Name = replace(Asset_Name,".ews.int","")</P> Tue, 29 Sep 2020 09:15:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-mvindex-command-to-remove-all-characters-after/m-p/262948#M78926 ddrillic 2020-09-29T09:15:38Z