Hello
I'm trying to use rtrim
to modify dns host name which I receive from domain controller. I'm using following search string:
| eval HostName=rtrim(HostName,".bankrc.local")
I tested this on hostname "hq-mileshin.bankrc.local"
but as a result I receive "hq-mileshi"
. Can you please help me to fix this and get a proper result: "hq-mileshin"
You can use replace function of Splunk for this
e.g.
| gentimes start=-1 | eval HostName="hq-mileshin.bankrc.local" | replace *.bankrc.local WITH * IN HostName
You can use replace function of Splunk for this
e.g.
| gentimes start=-1 | eval HostName="hq-mileshin.bankrc.local" | replace *.bankrc.local WITH * IN HostName