topic Re: Extract sub string from address in Splunk Search

Extract sub string from address

sndpgiri — Thu, 07 Oct 2021 01:34:35 GMT

I have the following address, and I want to extract the substring.

Address: 121, riverstreet, sydney, Australia.

I want to extract 'sydney'.

Help would be highly appreciated.

ITWhisperer — Thu, 07 Oct 2021 07:01:02 GMT

Assuming you already have the Address in a field called Address

| eval city=mvindex(split(Address,","),3) or | rex field=Address "([^,]+,){2}(?<city>[^,]+)"

Otherwise, use

| rex "Address:\s([^,]+,){2}(?<city>[^,]+)"