Splunk Search

Eval RegEx for Host Name from FQDN

jhayIV
Engager

Is there a way to write an eval to pull back host name Server1 from Server1.12.city.net

Tags (2)
0 Karma

somesoni2
Revered Legend

You can use eval or rex to get the server name. Assuming host name is first portion in FQDN which is dot separated, try this (say hostname is the field name which contains FQDN, change the field name per your need)

your base search | eval hostname=mvindex(split(hostname,"."),0) 

or

your base search | eval hostname=replace(hostname,"^([^\.]+).+","\1") 

or

your base search | rex field=hostname "^(?<hostname>[^\.]+)"

gokadroid
Motivator

Can you please try this:

your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(?<remainingPart>[\S]+)"
| table serverName

If city.net always comes as a suffix, this might also work:

your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(.+\.)*city\.net"
| table serverName
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...