topic Re: Splunk - retrieve nth word in a string in Splunk Search

Splunk - retrieve nth word in a string

rupesh30n — Fri, 06 Jun 2014 22:20:07 GMT

Hi,

How can I retrieve nth word in a string using rex or other alternatives?

For example:
"ABC BBC XYZ QAS"

"POP IMP RIL WER"

I want to extract XYZ and RIL here. Please note that they will always be the 3rd word but number of characters before them can vary.

lguinn2 — Fri, 06 Jun 2014 22:38:55 GMT

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

rupesh30n — Fri, 06 Jun 2014 23:08:05 GMT

Thanks Iguinn. That worked and you saved my day!!.

Is there a way we can generalize number of \S+\s+ instead of keep it adding to extract say 20th word?

MuS — Mon, 09 Jun 2014 07:53:24 GMT

try

| rex field=youroldfield "(\S+\s+){19}(?<yournewfield>\S+)\s"

this will match 19 times a group of any character that is not a whitespace character followed by spaces, the next match will be your 20th field 😉

rupesh30n — Tue, 10 Jun 2014 05:57:11 GMT

Thanks MuS for a great suggestion.