Hello Splunker,
Since I am not computer science major, I have a hard time with Regex.
I have fields value with lxw0000.usr.osd.mil, amico0000, alsedx.osd.mil and so much more with variation.
How can I extract value before the first period?
for example just
Server
lxw0000
amico0000
alsedx
when I use the (?<server>.*).\ , it does not show the amico0000.
Your quick help will be appreciated.
Thanks.
It depends on what delimits your string - I have assumed either dot or space
| rex "^(?<server>[^\.\s]+)"
| makeresults
| eval n="lxw0000.usr.osd.mil,amico0000,alsedx.osd.mil"
| makemv delim="," n
| rex field="n" "^(?<host>\w+)\.?"
First three lines to generate your test dataset. Will extract anything before your first "." (which is optional)
It depends on what delimits your string - I have assumed either dot or space
| rex "^(?<server>[^\.\s]+)"