Eval RegEx for Host Name from FQDN

[jhayIV]

Is there a way to write an eval to pull back host name Server1 from Server1.12.city.net

[somesoni2]

You can use eval or rex to get the server name. Assuming host name is first portion in FQDN which is dot separated, try this (say hostname is the field name which contains FQDN, change the field name per your need)

your base search | eval hostname=mvindex(split(hostname,"."),0) 

or

your base search | eval hostname=replace(hostname,"^([^\.]+).+","\1") 

or

your base search | rex field=hostname "^(?<hostname>[^\.]+)"

[gokadroid]

Can you please try this:

your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(?<remainingPart>[\S]+)"
| table serverName

If city.net always comes as a suffix, this might also work:

your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(.+\.)*city\.net"
| table serverName