Splunk Search

how to reverse field value in Splunk

joomla
Engager

Hi Team,

 

I have a field name domain with value "www.microsoft.com"; how I can reverse that and make it to "com.microsoft.www"

 

domain=www.microsoft.com

required: domain=com.microsoft.www

 

Many Thanks.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is a new one to me.  If the domain is always 3 parts you can split the domain then use foreach to put the pieces back together in reverse order as in this run-anywhere example.

| makeresults 
| eval domain="www.microsoft.com" 
``` Above just creates demo data ```
``` Break the domain at each dot ```
| eval foo=split(domain,".") 
``` Iterate over the segments in reverse order and put them together ```
| foreach 2 1 0 [ eval rev_domain=mvjoin(mvappend(rev_domain,mvindex(foo,<<FIELD>>)),".")] 
| table domain rev_domain
---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joomla,

if the structure is fixed, you can use a regex, otherwise I suppose that it isn't possible:

<your_search>
| rex field=domain "^(?<part1>[^\.]+)\.^(?<part2>[^\.]+)\.^(?<part3>[^\.]+)"
| eval new_domain=part3.".".part2.".".part1
| table domain new_domain

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval _domain=split(domain,".")
| foreach mode=multivalue _domain
    [| eval dom=if(isnull(dom),<<ITEM>>,<<ITEM>>.".".dom)]
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...