You can use eval or rex to get the server name. Assuming host name is first portion in FQDN which is dot separated, try this (say hostname is the field name which contains FQDN, change the field name per your need)
your base search | eval hostname=mvindex(split(hostname,"."),0)
or
your base search | eval hostname=replace(hostname,"^([^\.]+).+","\1")
or
your base search | rex field=hostname "^(?<hostname>[^\.]+)"
Can you please try this:
your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(?<remainingPart>[\S]+)"
| table serverName
If city.net
always comes as a suffix, this might also work:
your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(.+\.)*city\.net"
| table serverName