Solved: How to remove data after the first period? - Splunk Community

Splunk Search

Hi Splunk Community,

I am trying to remove the data in a field after the first period. my field looks like this:

24611_abce.XXX.AAA.com

24612_r1q2e3.XXX.AAA.com

null

null

4iop45_q7w8e9.XXX.AAA.com

hki90lhf3_m1n2b3.QQQQ.AAA.com

I would like to remove everything after the first period for every row but the pattterns at the end do not match after the first period. It should look like this:

24611_abce

24612_r1q2e3

null

null

4iop45_q7w8e9

hki90lhf3_m1n2b3

thanks in advance!

1 Solution

Solution

In your environment, you should try:

<your search>
| rex field=<fieldname> "^(?<custom_fieldname>[^\.]+)"

try this run anywhere search:

| makeresults 
| eval data="24611_abce.XXX.AAA.com,24612_r1q2e3.XXX.AAA.com,null,null,4iop45_q7w8e9.XXX.AAA.com,hki90lhf3_m1n2b3.QQQQ.AAA.com" 
| makemv data delim="," 
| mvexpand data 
| rex field=data "^(?<data>[^\.]+)"

let me know if this helps!

View solution in original post

Solution

In your environment, you should try:

<your search>
| rex field=<fieldname> "^(?<custom_fieldname>[^\.]+)"

try this run anywhere search:

| makeresults 
| eval data="24611_abce.XXX.AAA.com,24612_r1q2e3.XXX.AAA.com,null,null,4iop45_q7w8e9.XXX.AAA.com,hki90lhf3_m1n2b3.QQQQ.AAA.com" 
| makemv data delim="," 
| mvexpand data 
| rex field=data "^(?<data>[^\.]+)"

let me know if this helps!

This worked like a charm. Thank you very much

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...