I'm trying to create a new field based on the host field. The new field (hostname) should only contain the shortname. The host field is currently a mix of fqdn and shortnames:
So far, this comes close to what I'm trying to achieve:
| rex field=host "(?P<hostname>[^ ]+?)\."
Works great for all entries that actually do have a dot (.) in the text (number1, 2, 4). The ones without a dot (.) return blank. How do I also include the ones that don't need modification at all? (number 3)
Any help greatly appreciated!