I have a field FQ with the value as "ServerName.domain.com"
I want to get only the server name in another field.
Please help.
Hi
Try this rex
|rex field=FQ "(?P<servername>^[^.]*)"
@veerendra_modi
|eval ServerName=mvindex(split(FQ,"."),0)
OR
|rex field=FQ "(?<ServerName>[\w-]+)"
If you have any other characters in the servername , then you have to include that as well in the rex.