topic Re: How to extract only first word from a field value in Splunk Search

How to extract only first word from a field value?

sashib — Thu, 02 Jun 2022 22:03:31 GMT

I need to extract only name values (first word value eg:james) from the below Name filed

I tried with rex field=Name mode=sed "s/\W+\s\w.*//g" but not working

Name

james buildingA

jack buildingB firstfloor

Can you please help me with this.

Re: How to extract only first word from a field value

ITWhisperer — Thu, 02 Jun 2022 22:00:34 GMT

| rex field=Name mode=sed "s/\W.*//g"

Re: How to extract only first word from a field value

sashib — Thu, 02 Jun 2022 22:15:58 GMT

@ITWhisperer I am not getting any results with this. Looks like it is replacing complete field value with Null/empty value

Re: How to extract only first word from a field value

ITWhisperer — Fri, 03 Jun 2022 05:20:08 GMT

It works with the example you provided - perhaps this wasn't an accurate enough representation of your events. The rex assumes that the very first character of the field is a letter or number as it replaces from the first non-letter/number (\W) onwards. Try it this way (which replaces from the first "space" onwards)

| rex field=Name mode=sed "s/\s.*//g"

Re: How to extract only first word from a field value?

gcusello — Fri, 03 Jun 2022 07:46:16 GMT

Hi @sashib,

let me understand: you want to extract the first word of a field (called e.g. "your_field") and put it into a field called Name, is it correct?

If this is you need, please try this:

| rex field=your_field "^(?<name>\w*)"

you can test the regex at https://regex101.com/r/9YZSF6/1

Ciao.

Giuseppe