How to remove text from host name in search results?

[lbogle]

Hey Splunkers,
I have a search that is successfully returning search results as needed, however, I'd like to clean up the results a little.

The search returns the following:

HostName=PC-USERNAME.DOMAINNAME.COM

There are some databases that this search references that do not have the .DOMAINNAME.COM tacked onto the end of it and in the name of standardizing the search output, i'd like to clean it up so that they all look the same.
Is it possible to remove .DOMAINNAME.COM from the HostNames in the search results?

Thanks!

[somesoni2 · Accepted solution]

There are many options, see this runanywhere sample search

|gentimes start=-1 |eval HostName="PC-USERNAME.DOMAINNAME.COM PC-USERNAME" 
| makemv HostName|mvexpand HostName 
| eval HostName1=mvindex(split(HostName,"."),0) 
| eval HostName2=replace(HostName,"(.*)(\.\w+\.\w+)","\1") 
| eval HostName3=HostName | rex field=HostName3 mode=sed "s/(\.\w+\.\w+)$//g"

[lbogle]

Just FYI, there are many PC-USERNAME.DOMAINNAME.COM in the results. Can a wild card be used to indicate anything before .DOMAINNAME.COM? And if so, what is the syntax?