How to drop domain from results

[fdevera]

In splunk I have fully qualified sources and destinations. Example:

src=host1.mydomain.com

When I table it out I just want it to show host1 without .mydomain.com

How do I do this?

[efavreau]

@fdevera  You could use a regular expression to create a new field for the subdomain, then call that new field in your table.

| rex field=src "(?<justthesubdomain>.+?(?=\.))"
| table justthesubdomain

[saravanan90 · Accepted solution]

Try  eval src=replace(src,".mydomain.com","")