Hi Team,
I have a field name domain with value "www.microsoft.com"; how I can reverse that and make it to "com.microsoft.www"
domain=www.microsoft.com
required: domain=com.microsoft.www
Many Thanks.
This is a new one to me. If the domain is always 3 parts you can split the domain then use foreach to put the pieces back together in reverse order as in this run-anywhere example.
| makeresults
| eval domain="www.microsoft.com"
``` Above just creates demo data ```
``` Break the domain at each dot ```
| eval foo=split(domain,".")
``` Iterate over the segments in reverse order and put them together ```
| foreach 2 1 0 [ eval rev_domain=mvjoin(mvappend(rev_domain,mvindex(foo,<<FIELD>>)),".")]
| table domain rev_domain
Hi @joomla,
if the structure is fixed, you can use a regex, otherwise I suppose that it isn't possible:
<your_search>
| rex field=domain "^(?<part1>[^\.]+)\.^(?<part2>[^\.]+)\.^(?<part3>[^\.]+)"
| eval new_domain=part3.".".part2.".".part1
| table domain new_domain
Ciao.
Giuseppe
| eval _domain=split(domain,".")
| foreach mode=multivalue _domain
[| eval dom=if(isnull(dom),<<ITEM>>,<<ITEM>>.".".dom)]