Splunk Search

How to use the mvindex command to remove all characters after the second period (.) for a field's values?

vrmandadi
Builder

Hello,

I am finding difficulty to use the mvindex command to remove all the characters after the second period (.). Below is the column name Asset_name which has those values:

Asset_Name

s.hal.ews.int
n2323paop-34.storage.ews.int

I want the output to be:

s7050qalv.hal
n2323paop-34.storage

Tags (3)
0 Karma
1 Solution

vrmandadi
Builder

I got it

eval "Asset Names"=mvindex(split('Asset Names',".ews"),0)

View solution in original post

wrangler2x
Motivator

Try this just all by itself:

| gentimes start=-1 | eval Asset_Name="n2323paop-34.storage.ews.int"
| eval "Asset Name"=replace(Asset_Name,"(.+)\.ews.*","\1")
| table "Asset Name" Asset_Name

The 1st line is for setup, the second does the work, and the third shows the two -- before and after.

0 Karma

ddrillic
Ultra Champion

A simplistic replace might be ok for you -
| eval new_Asset_Name = replace(Asset_Name,".ews.int","")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is your current query? Is your sample data a single event with two asset names or two events with one asset name each?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

I got it

eval "Asset Names"=mvindex(split('Asset Names',".ews"),0)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...