What is the best way to remove dots from domain?

[bosseres]

Hello everyone!

What is the best way to remove dots from domain in field?

for example | eval field = lower(mvindex(split(field, "."), 0)) removes just 1 dot, and what if 2+ dots in domain?

[kamlesh_vaghela]

@bosseres 

if you want to just replace the value you can use replace function.

Like

 |eval field = replace(field,"\.","")

Can you please try this?

| makeresults | eval _raw = "field
abc.com
1.abc.com
2.1.abc.com
3.2.1.abc.com"| multikv forceheader=1
 |eval field = replace(field,"\.","")

if it's still not working, please provide your expected output for below sample data.

abc.com
1.abc.com
2.1.abc.com
3.2.1.abc.com

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

[bosseres]

I mean I want to remove part after dot

(for example google.domain.domain - must become google, google.domain1.domain2.domain3 must become google too, etc)

[isoutamo]

You could also use rex with sed mode like

....
| rex mode=sed field=<your field> "s/([^\.]+)(\..*)/$1/g"

[kamlesh_vaghela]

@bosseres 

Your search will work fine as you are selecting the first index after the split.

| eval field = lower(mvindex(split(field, "."), 0))

| makeresults | eval _raw = "field
abc.com
google.domain.domain
google.domain1.domain2.domain3
3.2.1.abc.com"| multikv forceheader=1
 | eval field = lower(mvindex(split(field, "."), 0))

🙂