if you want to just replace the value you can use replace function.
Like
|eval field = replace(field,"\.","")
Can you please try this?
| makeresults | eval _raw = "field
abc.com
1.abc.com
2.1.abc.com
3.2.1.abc.com"| multikv forceheader=1
|eval field = replace(field,"\.","")
if it's still not working, please provide your expected output for below sample data.
abc.com
1.abc.com
2.1.abc.com
3.2.1.abc.com
Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.
I mean I want to remove part after dot
(for example google.domain.domain - must become google, google.domain1.domain2.domain3 must become google too, etc)
You could also use rex with sed mode like
....
| rex mode=sed field=<your field> "s/([^\.]+)(\..*)/$1/g"
Your search will work fine as you are selecting the first index after the split.
| eval field = lower(mvindex(split(field, "."), 0))
| makeresults | eval _raw = "field
abc.com
google.domain.domain
google.domain1.domain2.domain3
3.2.1.abc.com"| multikv forceheader=1
| eval field = lower(mvindex(split(field, "."), 0))
🙂