How to achieve conditional formatting of values with eval if and regex?

[erikschubert]

Hello everyone,

I have the following field and example value: sourcePort=514.000

I'd like to format these fields in such a way, that only the first digits until the point are kept. Furthermore, this should only apply to a certain group of events (group one). 
Basically: 
before: sourcePort=514.000
after:    sourcePort=514

What I have until now:
search...
| eval sourcePort=if(group=one, regex part, sourcePort)

The regex to match only the digits is  ^\d{1,5}
However, I am unsure how to work with the regex and if it is even possible to achieve my goal using this.

Thanks in advance

[tpickle]

I would use split and mvindex instead of rex:

| eval sourcePort=if(group=one,mvindex(split(sourcePort,"."),0),sourcePort)

[diogofgm]

You can use | rex to achieve that:

|rex field=sourcePort "(?<src_port>\d{1,5})"
|eval sourcePort=if(group=one,src_port,sourcePort)

[ITWhisperer]

You can use the replace function (which supports regex)

| eval sourcePort=if(group=one,replace(sourcePort,"(?<p>\d{1,5})\.(?<q>.*)","\1"),sourcePort)