Splunk Search

Extract host name from FQDN while searching.

Ravan
Path Finder

Hi,

How can we extract hostname from FQDN at runtime(Need to include with in the query)

Ex: myhost.domain.com (OR) myhost.subdomain.maindomain.com

we need only myhost here ...

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Hi there,

I am assuming that you want to extract the hostname into a new field (since 'host' is a field that is always set). Just getting the host part of a FQDN is pretty straightforward (assuming that your field is called "FQDN");

... | rex field=FQDN "(?<host_name>[^.]+)\." | table host_name

and you can start using the new field straight away, as indicated above.

hope this helps,

Kristian

Ravan
Path Finder

in this case i have three fields (host,ip,os) , and we need to set the values in same "host"field.

Actual data :
host ip os
mywi2.R2.devel.in.com win
pctx1.R2.devel.in.com win
masymf.R1.prod.in.com win
swgdas.R2.devel.in.com win
dass.R2.devel.in.com win
swssch.R2.devel.in.com win

0 Karma

lguinn2
Legend

In order to help, we need to know more about the data - an example of the actual data (with identifying information anonymized) would be helpful. Also, are you talking about setting the value of the host field, or do you want to create a different field?

I assume that different events in the same input stream could have different hostnames.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...