Removing FQDN from field values

[RanjiRaje]

Removing FQDN from field values

Hi all, can anyone help me with framing the SPL query for the below requirement.

I have a field named Host which contains multiple values. some of them includes FQDN in various format at the end of the hostname.

eg: Host (value1.corp.abc.com, value2.abc.com,  value3.corp.abc, value4.xyz.com,  value5.klm.corp, value6.internal, value7.compute.internal, etc...)

In this, I need to get Host value as (value1, value2, value3, value4, value5, value6, value7) in my result by removing all types of FQDN.

Please can you help. Thanks in advance.

[richgalloway · Accepted solution]

There may be many ways to do that.  Here's one.

...
| rex field=Host "(?<part1>[^\.]+)"
``` If the field just extracted is a number then the Host field probably is an IP address ```
| eval Host = if(isnum(part1), Host, part1)
...

[RanjiRaje]

Hi sir, Now I got it and your command is perfectly working fine with all scenarios. thanks much

[RanjiRaje]

Hi sir, thanks for your spontaneous reply. 

I tried with this command and it worked. But i missed to inform that I have IP address as well under host field. Please guide me on this scenario. Thanks