Splunk Search

How to modify the results in required format?

pavanae
Builder

I have a lookup query as follows

| inputlookup hosts.csv | rename hostname as my_hostname | table my_hostname

the results are follows

abcd
abcf.sjs.com
GHK
ghli.sjd.com

How can I modify my query to display the results in the below format for the above results

abcd
abcf
GHK
ghli

I want to remove the letters after dot in the results and just want to display the words like above

0 Karma
1 Solution

cmerriman
Super Champion

try adding this to the end:

|rex mode=sed field=my_hostname "s/\..*//g"

View solution in original post

cmerriman
Super Champion

try adding this to the end:

|rex mode=sed field=my_hostname "s/\..*//g"
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...