I'm trying to create a new field based on the host field. The new field (hostname) should only contain the shortname. The host field is currently a mix of fqdn and shortnames:
server1.linux.splunk.co.uk
server2.linux.splunk.co.uk
server3
server4.linux.splunk.co.uk
So far, this comes close to what I'm trying to achieve:
| rex field=host "(?P<hostname>[^ ]+?)\."
Works great for all entries that actually do have a dot (.) in the text (number1, 2, 4). The ones without a dot (.) return blank. How do I also include the ones that don't need modification at all? (number 3)
Any help greatly appreciated!
It's too greedy to put against just a block of text, but as long as the field is sanitary, this should work:
(?P<hostname>[^.]+)
It's too greedy to put against just a block of text, but as long as the field is sanitary, this should work:
(?P<hostname>[^.]+)
It does! Kudo's for you, my friend!