I am finding difficulty to use the mvindex command to remove all the characters after the second period (.). Below is the column name Asset_name which has those values:
I want the output to be:
I got it
eval "Asset Names"=mvindex(split('Asset Names',".ews"),0)
What is your current query? Is your sample data a single event with two asset names or two events with one asset name each?
Try this just all by itself:
| gentimes start=-1 | eval Asset_Name="n2323paop-34.storage.ews.int" | eval "Asset Name"=replace(Asset_Name,"(.+)\.ews.*","\1") | table "Asset Name" Asset_Name
The 1st line is for setup, the second does the work, and the third shows the two -- before and after.
A simplistic replace might be ok for you -
| eval newAssetName = replace(Asset_Name,".ews.int","")