Splunk Search

How to modify the results in required format?

pavanae
Builder

I have a lookup query as follows

| inputlookup hosts.csv | rename hostname as my_hostname | table my_hostname

the results are follows

abcd
abcf.sjs.com
GHK
ghli.sjd.com

How can I modify my query to display the results in the below format for the above results

abcd
abcf
GHK
ghli

I want to remove the letters after dot in the results and just want to display the words like above

0 Karma
1 Solution

cmerriman
Super Champion

try adding this to the end:

|rex mode=sed field=my_hostname "s/\..*//g"

View solution in original post

cmerriman
Super Champion

try adding this to the end:

|rex mode=sed field=my_hostname "s/\..*//g"
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...