Search code examples
regexsplunksplunk-query

Regex to remove everything after -i- (with -i-)

I was trying to find solution for my problem.

 Input: prd-abcd-efgh-i-0dflnk55f5d45df

 Output: prd-abcd-efgh

Tried Splunk Query : index=aws-* (host=prd-abcd-efgh*) | rex field=host "^(?<host>[^.]+)"| dedup host  | stats count by host,methodPath

I want to remove everything comes after "-i-" using simple regex.I tried with regex "^(?[^.]+)" listed here

https://answers.splunk.com/answers/77101/extracting-selected-hosts-with-regex-regex-hosts-with-exceptions.html

Please help me to solve it.

Solution

  • replace(host, "(?<=-i-).*", "")

    Example here: https://regex101.com/r/blcCcQ/2

    This (?<=-i-) is a lookbehind