Splunk Search

how to reverse field value in Splunk

joomla
Engager

Hi Team,

 

I have a field name domain with value "www.microsoft.com"; how I can reverse that and make it to "com.microsoft.www"

 

domain=www.microsoft.com

required: domain=com.microsoft.www

 

Many Thanks.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is a new one to me.  If the domain is always 3 parts you can split the domain then use foreach to put the pieces back together in reverse order as in this run-anywhere example.

| makeresults 
| eval domain="www.microsoft.com" 
``` Above just creates demo data ```
``` Break the domain at each dot ```
| eval foo=split(domain,".") 
``` Iterate over the segments in reverse order and put them together ```
| foreach 2 1 0 [ eval rev_domain=mvjoin(mvappend(rev_domain,mvindex(foo,<<FIELD>>)),".")] 
| table domain rev_domain
---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joomla,

if the structure is fixed, you can use a regex, otherwise I suppose that it isn't possible:

<your_search>
| rex field=domain "^(?<part1>[^\.]+)\.^(?<part2>[^\.]+)\.^(?<part3>[^\.]+)"
| eval new_domain=part3.".".part2.".".part1
| table domain new_domain

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval _domain=split(domain,".")
| foreach mode=multivalue _domain
    [| eval dom=if(isnull(dom),<<ITEM>>,<<ITEM>>.".".dom)]
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...