Valide Regex expression do not work for Event rule

[Amar_Be]

Hi

In an event rule, I'm trying to extract the name of a server from its FQDN (in the node field).

So I have ABCD.internal.server and I want to have ABCD what ever can be the other parts of the fqdn.

When I test the expression (\w+)\.   on https://regex101.com/  it works very fine.

But once put in the "Transform and Compose Alert Output" tab of an event rule the regex returns nothing and a get a field with value "<<UNKNOWN>>" in the generated alert.

There is different expressions that can be used to extract the characters before the dot but none of them work once used in the alert rule.

Does any have already been able to do it?

Thanks

[Amar_Be · Accepted solution]

I've found the solution.

The difference between Servicenow and regex101 is that service now need to first select all the message then isolate the desired part.

so (\w+) select nothing then try to isolate the first word.

(\w+).+    works as it first select everything then isolate the first word.