How to remove data after the first period?

[jpfrancetic]

Hi Splunk Community,

I am trying to remove the data in a field after the first period. my field looks like this:

24611_abce.XXX.AAA.com

24612_r1q2e3.XXX.AAA.com

null

null

4iop45_q7w8e9.XXX.AAA.com

hki90lhf3_m1n2b3.QQQQ.AAA.com

I would like to remove everything after the first period for every row but the pattterns at the end do not match after the first period. It should look like this: 

24611_abce

24612_r1q2e3

null

null

4iop45_q7w8e9

hki90lhf3_m1n2b3

thanks in advance!

[mayurr98 · Accepted solution]

In your environment, you should try:

<your search>
| rex field=<fieldname> "^(?<custom_fieldname>[^\.]+)"

try this run anywhere search:

| makeresults 
| eval data="24611_abce.XXX.AAA.com,24612_r1q2e3.XXX.AAA.com,null,null,4iop45_q7w8e9.XXX.AAA.com,hki90lhf3_m1n2b3.QQQQ.AAA.com" 
| makemv data delim="," 
| mvexpand data 
| rex field=data "^(?<data>[^\.]+)"

let me know if this helps!

[jpfrancetic]

This worked like a charm. Thank you very much