Splunk Search

How to change each instance of a field search result?

atebysandwich
Path Finder

I'm doing a search for server names and will eventually extract to to a csv. However, each result comes out as one of the following


  • servername.domain: servername.domain
    servername: servername.domain
    servername: servername

How can I change the results in that particular field to be just servername? I feel like this is where regular expressions may come in to play. 

Labels (2)
Tags (1)
0 Karma
1 Solution

atebysandwich
Path Finder

I was able to figure out the issue without regex - I was looking at the wrong field. Thank you for the help, 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex field=particular "\w+:(?<servername>\w+)\.)"
0 Karma

atebysandwich
Path Finder

Unfortunately that didn't work. The field results still come out the same. But I noticed they come out in a few different ways:

servername.domain: servername.domain
servername: servername.domain
servername: servername

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample events in a code block </> since normal pasting can alter the (white-space) formatting.

0 Karma

atebysandwich
Path Finder

I was able to figure out the issue without regex - I was looking at the wrong field. Thank you for the help, 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...