edit fields

[sphiwee]

I have the below column whereby im pinging the url in the column, but for a nicer view I only want to display 

the pc name eg "03131bipc142w"  is this possible?

sphiwee_0-1625156354876.png

[kamlesh_vaghela]

@sphiwee 

Can you please try this?

YOUR_SEARCH
|rex field=url "(?<pc_name>[a-z0-9|-]+)\.[a-z0-9|-]+\.[a-z0-9|-]+\.[a-z]+"

My Sample Search :

| makeresults | eval url="http://030313bipc142w.za.sbicdirectory.com:4444/grid/console"
|rex field=url "(?<pc_name>[a-z0-9|-]+)\.[a-z0-9|-]+\.[a-z0-9|-]+\.[a-z]+"

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[gcusello · Accepted solution]

Hi @sphiwee,

if your request is how to modify a log in Splunk, the answer is: not possible on already indexed logs!

if your request is to modify the field uri displayed in the dashboard, you can use a regex to extract only the part of the field that you want, please try something like this:

your_search
| rex field=uri "http:\/\/(?<url>[^\.]+)"
| table url

that you can test at https://regex101.com/r/eekkf4/1

Ciao.

Giuseppe