Splunk Search

How to drop domain from results

Path Finder

In splunk I have fully qualified sources and destinations. Example:


When I table it out I just want it to show host1 without .mydomain.com

How do I do this?

Labels (3)
0 Karma
1 Solution


Try  eval src=replace(src,".mydomain.com","")

View solution in original post


@fdevera  You could use a regular expression to create a new field for the subdomain, then call that new field in your table.

| rex field=src "(?<justthesubdomain>.+?(?=\.))"
| table justthesubdomain



If this reply helps you, an upvote would be appreciated.


Try  eval src=replace(src,".mydomain.com","")

Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...