rtrim trims additional symbols

[ArsenyKapralov]

Hello

I'm trying to use rtrim to modify dns host name which I receive from domain controller. I'm using following search string:

 | eval HostName=rtrim(HostName,".bankrc.local")

I tested this on hostname "hq-mileshin.bankrc.local" but as a result I receive "hq-mileshi". Can you please help me to fix this and get a proper result: "hq-mileshin"

[somesoni2 · Accepted solution]

You can use replace function of Splunk for this

e.g.

| gentimes start=-1 | eval HostName="hq-mileshin.bankrc.local"  | replace *.bankrc.local WITH * IN HostName