https://community.splunk.com/t5/Splunk-Search/How-do-you-regex-a-part-of-a-field-name-to-use-in-a-separate/m-p/455001#M128712 <P>I have a field which is a username, but the results of the username starts with "USR" and the actual username is "USRAjames".</P> <P>I actually need to get the "A" and the "james" and put it in seperate field.</P> <P>Thoughts?</P> Mon, 29 Oct 2018 20:30:26 GMT barney00 2018-10-29T20:30:26Z https://community.splunk.com/t5/Splunk-Search/How-do-you-regex-a-part-of-a-field-name-to-use-in-a-separate/m-p/455001#M128712 <P>I have a field which is a username, but the results of the username starts with "USR" and the actual username is "USRAjames".</P> <P>I actually need to get the "A" and the "james" and put it in seperate field.</P> <P>Thoughts?</P> Mon, 29 Oct 2018 20:30:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-regex-a-part-of-a-field-name-to-use-in-a-separate/m-p/455001#M128712 barney00 2018-10-29T20:30:26Z https://community.splunk.com/t5/Splunk-Search/How-do-you-regex-a-part-of-a-field-name-to-use-in-a-separate/m-p/455002#M128713 <P>you can try this</P> <PRE><CODE>rex field=username "USR(?&lt;fname&gt;\w{1})\w+"| rex field=username "USR\w{1}(?&lt;lname&gt;\w+)" </CODE></PRE> Mon, 29 Oct 2018 21:38:34 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-regex-a-part-of-a-field-name-to-use-in-a-separate/m-p/455002#M128713 Vijeta 2018-10-29T21:38:34Z https://community.splunk.com/t5/Splunk-Search/How-do-you-regex-a-part-of-a-field-name-to-use-in-a-separate/m-p/455003#M128714 <P>A simplistic one ; - ) - <CODE>USR(?&lt;afield&gt;A)(?&lt;name&gt;.*)</CODE></P> Tue, 30 Oct 2018 00:44:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-regex-a-part-of-a-field-name-to-use-in-a-separate/m-p/455003#M128714 ddrillic 2018-10-30T00:44:11Z