Extract Field value

[Zenun]

Hello Splunker,

Since I am not computer science major, I have a hard time with Regex.

I have fields value with lxw0000.usr.osd.mil, amico0000, alsedx.osd.mil and so much more with variation.

How can I extract value before the first period?

for example just

Server

lxw0000

amico0000

alsedx

when I use the  (?<server>.*).\  , it does not show the amico0000.

Your quick help will be appreciated.

Thanks.

[s2_splunk]

| makeresults 
| eval n="lxw0000.usr.osd.mil,amico0000,alsedx.osd.mil" 
| makemv delim="," n 
| rex field="n" "^(?<host>\w+)\.?"

First three lines to generate your test dataset. Will extract anything before your first "." (which is optional)

[ITWhisperer · Accepted solution]

It depends on what delimits your string - I have assumed either dot or space

| rex "^(?<server>[^\.\s]+)"

[Zenun]

Thank you both for the quick solution.  have a great day!