Split and display

[priya0709]

My requirement is to display just domain (eg Corp)

From below Computername

Computername - <host>. Corp. <Domain>. Com

[ITWhisperer]

It isn't clear if "Computername" is part of the field you are trying to extract from or the name of the field. If it is part of the field (assuming _raw)

| rex "Computername - \w+\.(?<Corp>[^\.]+)\.Com"

 If it is the field name

| rex field=Computername "^\w+\.(?<Corp>[^\.]+)\.Com"

This assume <host> is at the beginning of Computername. If not, just remove the ^ from the beginning

Both of these assume that there are only two dots in the computername 

[priya0709]

Hi

Thanks for your reply

Computername is from raw dat

But actual field is 'Hostdomain' under which I want to display 'corp' from computername

Computername format - -

<HOST>. Corp. <domain>. com

[ITWhisperer]

In that case

| rex field=Hostdomain "^[^\.]+\.(?<Corp>[^\.]+)"

[bowesmana · Accepted solution]

You can use either split or rex

| rex field=Computername "[^\.]*\.(?<Corp>[^\.]*)"

OR 

| eval Corp=mvindex(split(Computername,"."),1,1)

Hope this helps