Splunk Search

How to change each instance of a field search result?

atebysandwich
Path Finder

I'm doing a search for server names and will eventually extract to to a csv. However, each result comes out as one of the following


  • servername.domain: servername.domain
    servername: servername.domain
    servername: servername

How can I change the results in that particular field to be just servername? I feel like this is where regular expressions may come in to play. 

Labels (2)
Tags (1)
0 Karma
1 Solution

atebysandwich
Path Finder

I was able to figure out the issue without regex - I was looking at the wrong field. Thank you for the help, 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex field=particular "\w+:(?<servername>\w+)\.)"
0 Karma

atebysandwich
Path Finder

Unfortunately that didn't work. The field results still come out the same. But I noticed they come out in a few different ways:

servername.domain: servername.domain
servername: servername.domain
servername: servername

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample events in a code block </> since normal pasting can alter the (white-space) formatting.

0 Karma

atebysandwich
Path Finder

I was able to figure out the issue without regex - I was looking at the wrong field. Thank you for the help, 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...