Splunk Search

How to split/extract substring before the first - from the right side of the string

keshavgupta
Engager
Spoiler
How to split/extract substring before the first - from the right side of the field on splunk search

For ex: My field hostname contains

Hostname = abc-xyz
Hostname = abc-01-def
Hostname = pqr-01

I want to see like below .

abc
abc-01
pqr

Please help me.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<host>[^\-]+)\-"
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...