How to change each instance of a field search result?

[atebysandwich]

I'm doing a search for server names and will eventually extract to to a csv. However, each result comes out as one of the following

• 
  servername.domain: servername.domain
  servername: servername.domain
  servername: servername

How can I change the results in that particular field to be just servername? I feel like this is where regular expressions may come in to play. 

[ITWhisperer]

Try something like this

| rex field=particular "\w+:(?<servername>\w+)\.)"

[atebysandwich]

Unfortunately that didn't work. The field results still come out the same. But I noticed they come out in a few different ways:

servername.domain: servername.domain
servername: servername.domain
servername: servername

[ITWhisperer]

Please share some sample events in a code block </> since normal pasting can alter the (white-space) formatting.

[atebysandwich · Accepted solution]

I was able to figure out the issue without regex - I was looking at the wrong field. Thank you for the help,