topic Re: Creating multiple fields by extracting values from single field in Splunk Search

Creating multiple fields by extracting values from single field

mbasharat — Sun, 16 Jun 2019 05:30:15 GMT

Hi,

I have a field name Family. This field contain names of husband and wife in below Figure 1 format:

All values for field “Family” are populated in above format. In value 1, Newman is the Last Name for both husband and wife. In value 2, Stewart is the Last Name for both husband and wife. Likewise will be for the rest of the values.

What I need is, from one Family field value, I need to extract Husband’s Full Name, Husband’s First Name, Husband’s Middle Initial, Husband’s Last Name, Wife’s Full Name, Wife’s Middle Initial, Wife’s Last Name in below Figure 2 format, how?

RegEx gives headache but if I have to have it then still ok but multiple evals will be better because it is easily understandable.

Thanks in-advance for assistance!!!

Re: Creating multiple fields by extracting values from single field

renjith_nair — Sun, 16 Jun 2019 09:21:25 GMT

@mbasharat ,

If the format of the field is same across all events, try

| rex field=Family "(?<Husband_First_Name>\w+)\s+(?<Husband_Middle_Name>\w+)\s+&\s+(?<Wife_First_Name>\w+)\s+(?<Wife_Middle_Name>\w+)\s+(?<LastName>\w+)"

Once the fields are available, you can concatenate them for e.g.

eval Husband_Name=Husband_First_Name." ".Husband_Middle_Name." ".LastName

Re: Creating multiple fields by extracting values from single field

mbasharat — Sun, 16 Jun 2019 13:21:15 GMT

Ranith...with slight adjustment for my use case....it worked perfectly...THANK YOU!!!! I will be reaching out to you for alike RegEx assistance if I may? 🙂

Re: Creating multiple fields by extracting values from single field

mbasharat — Sun, 16 Jun 2019 13:22:40 GMT

Also, is there a free tool or web portal where I can create these RegExs conveniently?