Splunk Search

regular expression to transformation



In my linux data, two versions of the same hostname have turned up.
and .local.
Now I have been able to change the host field using both

eval host=replace(host, ".local", "")


rex mode=sed field=host "s/.local//g"

at searchtime, but I'm having issues setting up a field transformation.

What do I fill in? These are my guesses...

Destination app: search
Name: remove .local
Type: regex-based

Regular expression: ".local(?\S+)" <-- something like this?

Format: Big questionmark
Source Key: host?

0 Karma