Hi,
How can we extract hostname from FQDN at runtime(Need to include with in the query)
Ex: myhost.domain.com (OR) myhost.subdomain.maindomain.com
we need only myhost here ...
Hi there,
I am assuming that you want to extract the hostname into a new field (since 'host' is a field that is always set). Just getting the host part of a FQDN is pretty straightforward (assuming that your field is called "FQDN");
... | rex field=FQDN "(?<host_name>[^.]+)\." | table host_name
and you can start using the new field straight away, as indicated above.
hope this helps,
Kristian
in this case i have three fields (host,ip,os) , and we need to set the values in same "host"field.
Actual data :
host ip os
mywi2.R2.devel.in.com
pctx1.R2.devel.in.com
masymf.R1.prod.in.com
swgdas.R2.devel.in.com
dass.R2.devel.in.com
swssch.R2.devel.in.com
In order to help, we need to know more about the data - an example of the actual data (with identifying information anonymized) would be helpful. Also, are you talking about setting the value of the host field, or do you want to create a different field?
I assume that different events in the same input stream could have different hostnames.