Splunk Search

How to use the mvindex command to remove all characters after the second period (.) for a field's values?

vrmandadi
Builder

Hello,

I am finding difficulty to use the mvindex command to remove all the characters after the second period (.). Below is the column name Asset_name which has those values:

Asset_Name

s.hal.ews.int
n2323paop-34.storage.ews.int

I want the output to be:

s7050qalv.hal
n2323paop-34.storage

Tags (3)
0 Karma
1 Solution

vrmandadi
Builder

I got it

eval "Asset Names"=mvindex(split('Asset Names',".ews"),0)

View solution in original post

wrangler2x
Motivator

Try this just all by itself:

| gentimes start=-1 | eval Asset_Name="n2323paop-34.storage.ews.int"
| eval "Asset Name"=replace(Asset_Name,"(.+)\.ews.*","\1")
| table "Asset Name" Asset_Name

The 1st line is for setup, the second does the work, and the third shows the two -- before and after.

0 Karma

ddrillic
Ultra Champion

A simplistic replace might be ok for you -
| eval new_Asset_Name = replace(Asset_Name,".ews.int","")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is your current query? Is your sample data a single event with two asset names or two events with one asset name each?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

I got it

eval "Asset Names"=mvindex(split('Asset Names',".ews"),0)

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...