Splunk Search

What is the best way to remove dots from domain?

bosseres
Contributor

Hello everyone!

What is the best way to remove dots from domain in field?

for example | eval field = lower(mvindex(split(field, "."), 0)) removes just 1 dot, and what if 2+ dots in domain?

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@bosseres 

if you want to just replace the value you can use replace function.

Like

 |eval field = replace(field,"\.","")

 

Can you please try this?

| makeresults | eval _raw = "field
abc.com
1.abc.com
2.1.abc.com
3.2.1.abc.com"| multikv forceheader=1
 |eval field = replace(field,"\.","")

 

if it's still not working, please provide your expected output for below sample data.

abc.com
1.abc.com
2.1.abc.com
3.2.1.abc.com

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

bosseres
Contributor

I mean I want to remove part after dot

(for example google.domain.domain - must become google, google.domain1.domain2.domain3 must become google too, etc)

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You could also use rex with sed mode like

 

....
| rex mode=sed field=<your field> "s/([^\.]+)(\..*)/$1/g"

 

kamlesh_vaghela
SplunkTrust
SplunkTrust

@bosseres 

Your search will work fine as you are selecting the first index after the split.

| eval field = lower(mvindex(split(field, "."), 0))

 

| makeresults | eval _raw = "field
abc.com
google.domain.domain
google.domain1.domain2.domain3
3.2.1.abc.com"| multikv forceheader=1
 | eval field = lower(mvindex(split(field, "."), 0))

 

Screenshot 2022-10-21 at 12.57.21 PM.png

 

:slightly_smiling_face:  

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...