Reporting

Extract Field value

Zenun
Engager

Hello Splunker,

Since I am not computer science major, I have a hard time with Regex.

I have fields value with lxw0000.usr.osd.mil, amico0000, alsedx.osd.mil and so much more with variation.

How can I extract value before the first period?

for example just

Server

lxw0000

amico0000

alsedx

when I use the  (?<server>.*).\  , it does not show the amico0000.

Your quick help will be appreciated.

Thanks.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what delimits your string - I have assumed either dot or space

| rex "^(?<server>[^\.\s]+)"

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee
| makeresults 
| eval n="lxw0000.usr.osd.mil,amico0000,alsedx.osd.mil" 
| makemv delim="," n 
| rex field="n" "^(?<host>\w+)\.?"

First three lines to generate your test dataset. Will extract anything before your first "." (which is optional)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what delimits your string - I have assumed either dot or space

| rex "^(?<server>[^\.\s]+)"
0 Karma

Zenun
Engager

Thank you both for the quick solution.  have a great day!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...