Truncate characters after a specific character using the Trim function

[ASplunkDummy]

Dear all, best wishes for 2022.

Is it possible to use rtrim to remove all characters out of a search result that come after a specific character? For example, using a FQDN, is it possible to use rtrim to remove every character after the host name (so after the dot)?

Original output: server1.domain.com

Desired output: server1

I am aware that regex can solve this, but I am looking for alternative options to solve this problem. This solution should ideally be working for any combination of servers and domain names.

Any help is welcome.

[richgalloway]

The rtrim function cannot do what you seek reliably.  You would have to give all characters as those to be trimmed and then you'd have nothing left.  rtrim doesn't have a concept trim-up-to-this-point.

If you don't want to use rex then how about replace()?

[ASplunkDummy]

Thanks for your suggestion. I tried this:

| eval ComputerName=replace(ComputerName, "^.*","([^\.]+)[\.].+")

This should look for any value in FQDN format and replace it with only the server name (every character before the first dot). It does replace the value of ComputerName, but it replaces it with the literal text. It ignores the fact the second part is also a regular expression. I am lost here. What do I miss?

[richgalloway · Accepted solution]

The replace function takes a regex only in the second argument.  The other two arguments are literal strings (or fields).

To replace a regex with another regex, use the rex command with the sed option.

| rex mode=sed field=ComputerName "s/^.*/([^\.]+)[\.].+/"