Splunk Search

Split and display

Path Finder

My requirement is to display just domain (eg Corp)

From below Computername

Computername - <host>. Corp. <Domain>. Com

Labels (1)
0 Karma
1 Solution

Motivator

You can use either split or rex

| rex field=Computername "[^\.]*\.(?<Corp>[^\.]*)"

OR 

| eval Corp=mvindex(split(Computername,"."),1,1)

Hope this helps

 

View solution in original post

Path Finder

It isn't clear if "Computername" is part of the field you are trying to extract from or the name of the field. If it is part of the field (assuming _raw)

| rex "Computername - \w+\.(?<Corp>[^\.]+)\.Com"

 If it is the field name

| rex field=Computername "^\w+\.(?<Corp>[^\.]+)\.Com"

This assume <host> is at the beginning of Computername. If not, just remove the ^ from the beginning

Both of these assume that there are only two dots in the computername 

0 Karma

Path Finder

Hi

Thanks for your reply

Computername is from raw dat

But actual field is 'Hostdomain' under which I want to display 'corp' from computername

Computername format - -

<HOST>. Corp. <domain>. com

0 Karma

Path Finder

In that case

| rex field=Hostdomain "^[^\.]+\.(?<Corp>[^\.]+)"
0 Karma

Motivator

You can use either split or rex

| rex field=Computername "[^\.]*\.(?<Corp>[^\.]*)"

OR 

| eval Corp=mvindex(split(Computername,"."),1,1)

Hope this helps

 

View solution in original post