Splunk Search

How to drop domain from results

fdevera
Path Finder

In splunk I have fully qualified sources and destinations. Example:

src=host1.mydomain.com

When I table it out I just want it to show host1 without .mydomain.com

How do I do this?

Labels (3)
0 Karma
1 Solution

saravanan90
Contributor

Try  eval src=replace(src,".mydomain.com","")

View solution in original post

efavreau
Motivator

@fdevera  You could use a regular expression to create a new field for the subdomain, then call that new field in your table.

| rex field=src "(?<justthesubdomain>.+?(?=\.))"
| table justthesubdomain

 

###

If this reply helps you, an upvote would be appreciated.

saravanan90
Contributor

Try  eval src=replace(src,".mydomain.com","")

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...