In splunk I have fully qualified sources and destinations. Example:src=host1.mydomain.com
When I table it out I just want it to show host1 without .mydomain.com
How do I do this?
Try eval src=replace(src,".mydomain.com","")
View solution in original post
@fdevera You could use a regular expression to create a new field for the subdomain, then call that new field in your table.
| rex field=src "(?<justthesubdomain>.+?(?=\.))"
| table justthesubdomain