Hey Splunkers,
I have a search that is successfully returning search results as needed, however, I'd like to clean up the results a little.
The search returns the following:
HostName=PC-USERNAME.DOMAINNAME.COM
There are some databases that this search references that do not have the .DOMAINNAME.COM tacked onto the end of it and in the name of standardizing the search output, i'd like to clean it up so that they all look the same.
Is it possible to remove .DOMAINNAME.COM from the HostNames in the search results?
Thanks!
There are many options, see this runanywhere sample search
|gentimes start=-1 |eval HostName="PC-USERNAME.DOMAINNAME.COM PC-USERNAME"
| makemv HostName|mvexpand HostName
| eval HostName1=mvindex(split(HostName,"."),0)
| eval HostName2=replace(HostName,"(.*)(\.\w+\.\w+)","\1")
| eval HostName3=HostName | rex field=HostName3 mode=sed "s/(\.\w+\.\w+)$//g"
There are many options, see this runanywhere sample search
|gentimes start=-1 |eval HostName="PC-USERNAME.DOMAINNAME.COM PC-USERNAME"
| makemv HostName|mvexpand HostName
| eval HostName1=mvindex(split(HostName,"."),0)
| eval HostName2=replace(HostName,"(.*)(\.\w+\.\w+)","\1")
| eval HostName3=HostName | rex field=HostName3 mode=sed "s/(\.\w+\.\w+)$//g"
Just FYI, there are many PC-USERNAME.DOMAINNAME.COM in the results. Can a wild card be used to indicate anything before .DOMAINNAME.COM? And if so, what is the syntax?