Reporting

Extract Field value

Zenun
Engager

Hello Splunker,

Since I am not computer science major, I have a hard time with Regex.

I have fields value with lxw0000.usr.osd.mil, amico0000, alsedx.osd.mil and so much more with variation.

How can I extract value before the first period?

for example just

Server

lxw0000

amico0000

alsedx

when I use the  (?<server>.*).\  , it does not show the amico0000.

Your quick help will be appreciated.

Thanks.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
Legend

It depends on what delimits your string - I have assumed either dot or space

| rex "^(?<server>[^\.\s]+)"

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee
| makeresults 
| eval n="lxw0000.usr.osd.mil,amico0000,alsedx.osd.mil" 
| makemv delim="," n 
| rex field="n" "^(?<host>\w+)\.?"

First three lines to generate your test dataset. Will extract anything before your first "." (which is optional)

0 Karma

ITWhisperer
Legend

It depends on what delimits your string - I have assumed either dot or space

| rex "^(?<server>[^\.\s]+)"

View solution in original post

0 Karma

Zenun
Engager

Thank you both for the quick solution.  have a great day!

Tags (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!