Splunk Search

Eval RegEx for Host Name from FQDN

Engager

Is there a way to write an eval to pull back host name Server1 from Server1.12.city.net

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

You can use eval or rex to get the server name. Assuming host name is first portion in FQDN which is dot separated, try this (say hostname is the field name which contains FQDN, change the field name per your need)

your base search | eval hostname=mvindex(split(hostname,"."),0) 

or

your base search | eval hostname=replace(hostname,"^([^\.]+).+","\1") 

or

your base search | rex field=hostname "^(?<hostname>[^\.]+)"

Motivator

Can you please try this:

your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(?<remainingPart>[\S]+)"
| table serverName

If city.net always comes as a suffix, this might also work:

your query to return the events
| rex "\s*(?<serverName>[^\.]+)\.(.+\.)*city\.net"
| table serverName
0 Karma