How do I trim a field in a Splunk dashboard?

[anthonyantos]

Hello,

I have a dashboard that I'm first appending to, example: |eval host=host." @ ".type which would result in myhost @ kc.

Then, I'm using a token to do a search, which would be index={myindex} source={mysource} $host$ *. I need to strip the host back to its original by removing the " @ kc" in this case.

I've tried the |makeresults "index={myindex} source={mysource} $host$ *" |rex mode=sed field=host "s/\s@\s\w+//g" but it won't return any results in my search.

Any help would be appreciated

[DalJeanis · Accepted solution]

Okay, so first, you haven't explained why you are adding the @.type Why don't you add it to a different version of the field, with a slightly different name, and then use the original for the new search?

Second, you can try something like this...

index={myindex} source={mysource} 
    [
    | makeresults 
    | eval host="$host$" 
    | table host 
    | rex mode=sed field=host "s/\s@\s\w+/*/g"
    ]

[anthonyantos]

Thanks for the assistance

[DalJeanis]

@anthonyantos - Glad we were able to help. You didn't tell us which one worked for your use case.... whether you went with the deeper fix, or whether the code worked. People researching their own problems later might find that information helpful... - dal