Splunk Search

How do you trim a value in a field with a proper format?

veerendra_modi
Loves-to-Learn

I have a field FQ with the value as "ServerName.domain.com"

I want to get only the server name in another field.

Please help.

Tags (1)
0 Karma

vnravikumar
Champion

Hi

Try this rex

|rex field=FQ "(?P<servername>^[^.]*)"

renjith_nair
SplunkTrust
SplunkTrust

@veerendra_modi

|eval ServerName=mvindex(split(FQ,"."),0)

OR

|rex field=FQ "(?<ServerName>[\w-]+)"

If you have any other characters in the servername , then you have to include that as well in the rex.

Happy Splunking!
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>