Splunk Search

How to remove text from host name in search results?

lbogle
Contributor

Hey Splunkers,
I have a search that is successfully returning search results as needed, however, I'd like to clean up the results a little.

The search returns the following:

HostName=PC-USERNAME.DOMAINNAME.COM

There are some databases that this search references that do not have the .DOMAINNAME.COM tacked onto the end of it and in the name of standardizing the search output, i'd like to clean it up so that they all look the same.
Is it possible to remove .DOMAINNAME.COM from the HostNames in the search results?

Thanks!

Tags (3)
1 Solution

somesoni2
Revered Legend

There are many options, see this runanywhere sample search

|gentimes start=-1 |eval HostName="PC-USERNAME.DOMAINNAME.COM PC-USERNAME" 
| makemv HostName|mvexpand HostName 
| eval HostName1=mvindex(split(HostName,"."),0) 
| eval HostName2=replace(HostName,"(.*)(\.\w+\.\w+)","\1") 
| eval HostName3=HostName | rex field=HostName3 mode=sed "s/(\.\w+\.\w+)$//g"

View solution in original post

somesoni2
Revered Legend

There are many options, see this runanywhere sample search

|gentimes start=-1 |eval HostName="PC-USERNAME.DOMAINNAME.COM PC-USERNAME" 
| makemv HostName|mvexpand HostName 
| eval HostName1=mvindex(split(HostName,"."),0) 
| eval HostName2=replace(HostName,"(.*)(\.\w+\.\w+)","\1") 
| eval HostName3=HostName | rex field=HostName3 mode=sed "s/(\.\w+\.\w+)$//g"

lbogle
Contributor

Just FYI, there are many PC-USERNAME.DOMAINNAME.COM in the results. Can a wild card be used to indicate anything before .DOMAINNAME.COM? And if so, what is the syntax?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...