Splunk Search

trim out field using replace

brdr
Contributor

I'm reading from a file that has messages like these:

Action (0x00000173): x.x.x.x; |Performed by user "User 1"
Action (0x00000173): host2.domain.com; |Performed by user "User 2"
Action (0x00000173): host3.CA.domain.com; |Performed by user "User 3"

After the lookup is done I have parsed out the host identifier (as either x.x.x.x, host2.domain.com, host3.CA.domain.com) as field host. Now I need to perform actions. If the host value is an IP address then do nothing. However, if the host value is not an IP address then strip off everything (and including .) after the first period.

I think the replace command will work but not getting it right... I have:

| eval host=if(match(host, "^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"), host, replace(host, 'do something here', 'do somethinge here'))

In the end I should I have:
x.x.x.x
host2
host3

Thank you

Tags (4)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

| eval host=if(match(host, "^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"), host, replace(host, "^([^\.]+)\..+","\1"))

View solution in original post

xpac
SplunkTrust
SplunkTrust

Try this:

| makeresults
| eval host="host3.CA.domain.com"
| eval host=if(match(host, "^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"), host, replace(host, "^([^\.]+)\..*$", "\1"))

More explanation here in the docs, explanation of the regex here.

brdr
Contributor

thx xpac for responding. the regular expression you provided me resulting in host field blank. I have the right answer now. 🙂

0 Karma

somesoni2
Revered Legend

Give this a try

| eval host=if(match(host, "^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"), host, replace(host, "^([^\.]+)\..+","\1"))

brdr
Contributor

Thanks somesoni2! work perfectly.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...