topic Re: How do you make a regular expression to extract the first 4 words in a sentence? in Splunk Search

How do you make a regular expression to extract the first 4 words in a sentence?

dojiepreji — Tue, 22 Jan 2019 10:45:51 GMT

I need to extract the first 4 words in a field with sample data like this,

"The team performs checks for the following dashboards".

What I want is to extract the first 4 words, like so,

"The team performs checks".

rex field=long_description ^(?<field1>\w+\s\d+)

I've made a rex command that will extract the first word. However, I'm having difficulty figuring out how to extract the first 4 words.

Can anybody please help me out?

Re: How do you make a regular expression to extract the first 4 words in a sentence?

saurabhkharkar — Tue, 22 Jan 2019 13:48:59 GMT

|makeresults
|eval string="The team performs checks for the following dashboards"
| rex field=string "(?<output>\w+\s+\w+\s+\w+\s+\w+).+"

Re: How do you make a regular expression to extract the first 4 words in a sentence?

richgalloway — Tue, 22 Jan 2019 13:58:27 GMT

Do you want the first 4 words in a single field or multiple fields. @saurabhkharkar's answer will put them into a single field. To get them in multiple fields, try this.

| rex field=long_description "(?<word1>\w+)\W+(?<word2>\w+)\W+(?<word3>\w+)\W+(?<word4>\w+)"

Re: How do you make a regular expression to extract the first 4 words in a sentence?

vnravikumar — Tue, 22 Jan 2019 14:16:09 GMT

Hi @dojiepreji

Please try

| makeresults 
| eval sample="The team performs checks for the following dashboards" 
| rex field=sample "(?P<output>(?:\S+\s){3}\S*).*"