Splunk Search

Truncate characters after a specific character using the Trim function

ASplunkDummy
Engager

Dear all, best wishes for 2022.

Is it possible to use rtrim to remove all characters out of a search result that come after a specific character? For example, using a FQDN, is it possible to use rtrim to remove every character after the host name (so after the dot)?

Original output: server1.domain.com

Desired output: server1

I am aware that regex can solve this, but I am looking for alternative options to solve this problem. This solution should ideally be working for any combination of servers and domain names.

Any help is welcome.

Labels (1)
Tags (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The replace function takes a regex only in the second argument.  The other two arguments are literal strings (or fields).

To replace a regex with another regex, use the rex command with the sed option.

| rex mode=sed field=ComputerName "s/^.*/([^\.]+)[\.].+/"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The rtrim function cannot do what you seek reliably.  You would have to give all characters as those to be trimmed and then you'd have nothing left.  rtrim doesn't have a concept trim-up-to-this-point.

If you don't want to use rex then how about replace()?

---
If this reply helps you, Karma would be appreciated.

ASplunkDummy
Engager

Thanks for your suggestion. I tried this:

| eval ComputerName=replace(ComputerName, "^.*","([^\.]+)[\.].+")

This should look for any value in FQDN format and replace it with only the server name (every character before the first dot). It does replace the value of ComputerName, but it replaces it with the literal text. It ignores the fact the second part is also a regular expression. I am lost here. What do I miss?

richgalloway
SplunkTrust
SplunkTrust

The replace function takes a regex only in the second argument.  The other two arguments are literal strings (or fields).

To replace a regex with another regex, use the rex command with the sed option.

| rex mode=sed field=ComputerName "s/^.*/([^\.]+)[\.].+/"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...