One way is
| rex field=mydnsfield "^(?<hostname>[^.]+)"
That will get everything that isn't a period, from the beginning, up to but not including the first period.
One way is
| rex field=mydnsfield "^(?<hostname>[^.]+)"
That will get everything that isn't a period, from the beginning, up to but not including the first period.
give this a try:
... | rex (?<field1>\w+)\.(?<field2>\w+)\.(?<field3>\w+)
https://regex101.com/r/uWt0Mf/1
hope it helps
@adonio - (1) That's going to fail if any of the host names don't have three or more nodes. You should probably make the last one optional. (2) What's the purpose of the final .
?
Thanks @DalJeanis!
wanted to demonstrate flexibility in case s/he needs more fields extracted
as always, great comments, appreciate it!
i guess the .
implies i am writing more in my journal lately and i am trying to end a sentence with a .
edited the answer