how to reverse field value in Splunk

[joomla]

Hi Team,

I have a field name domain with value "www.microsoft.com"; how I can reverse that and make it to "com.microsoft.www"

domain=www.microsoft.com

required: domain=com.microsoft.www

Many Thanks.

[richgalloway]

This is a new one to me.  If the domain is always 3 parts you can split the domain then use foreach to put the pieces back together in reverse order as in this run-anywhere example.

| makeresults 
| eval domain="www.microsoft.com" 
``` Above just creates demo data ```
``` Break the domain at each dot ```
| eval foo=split(domain,".") 
``` Iterate over the segments in reverse order and put them together ```
| foreach 2 1 0 [ eval rev_domain=mvjoin(mvappend(rev_domain,mvindex(foo,<<FIELD>>)),".")] 
| table domain rev_domain

[gcusello]

Hi @joomla,

if the structure is fixed, you can use a regex, otherwise I suppose that it isn't possible:

<your_search>
| rex field=domain "^(?<part1>[^\.]+)\.^(?<part2>[^\.]+)\.^(?<part3>[^\.]+)"
| eval new_domain=part3.".".part2.".".part1
| table domain new_domain

Ciao.

Giuseppe

[ITWhisperer]

| eval _domain=split(domain,".")
| foreach mode=multivalue _domain
    [| eval dom=if(isnull(dom),<<ITEM>>,<<ITEM>>.".".dom)]