Splunk Search

How to drop domain from results

fdevera
Path Finder

In splunk I have fully qualified sources and destinations. Example:

src=host1.mydomain.com

When I table it out I just want it to show host1 without .mydomain.com

How do I do this?

Labels (3)
0 Karma
1 Solution

saravanan90
Contributor

Try  eval src=replace(src,".mydomain.com","")

View solution in original post

efavreau
Motivator

@fdevera  You could use a regular expression to create a new field for the subdomain, then call that new field in your table.

| rex field=src "(?<justthesubdomain>.+?(?=\.))"
| table justthesubdomain

 

###

If this reply helps you, an upvote would be appreciated.

saravanan90
Contributor

Try  eval src=replace(src,".mydomain.com","")

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...