we have logs that include a host-name which is always appended by the FQDN. The FQDN is always the same and is not needed for a high level dashboard.
This makes the field too long for a cell in a table on a dashboard and messes up the formatting of the table and therefore the page.
I've amended the indexing so all new data includes an additional field of just host-name
Is it possible (at search time) to remove this for data already indexed?
"hostname.domainname.com" to become "hostname"
Thanks
answered my own question
what a dufus.
field extraction to create new field
been a long morning...
Hi,
You can try editing the field by using eval command. Following is an example:
| eval hostname=replace(hostname,"hostname.domainname.com","hostname")
Thanks!!
Thanks for the comment, but the "hostname" portion of the FQDN is the variable.
Can use regex to extract the host but can you use regex to write the new string?
hostname="replace(hostname,"REGEXvalue.domainname.com,"REGEXvalue)
the example in the docs uses a static value as an output
... | eval n=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/")
answered my own question
what a dufus.
field extraction to create new field
been a long morning...