topic Re: Extract a field from a field in splunk? in Splunk Search

Extract a field from a field in splunk?

pavanae — Mon, 08 Aug 2022 20:06:22 GMT

I have a field names "code_value" which has the values as follows

code_value ABC-123 JHLIK ABC-456 LKJF ABC-781 klklk ABC-22 olsd

Now how do I extract the code_value field anything that comes before a space? something like below

new_field_derived_from_code_value ABC-123 ABC-456 ABC-781 ABC-22

richgalloway — Mon, 08 Aug 2022 20:41:04 GMT

For extracting a field from a field use the rex command. This regex puts everything up to the first space into the new field.

| rex field=code_value "(?<new_field_derived_from_code_value>\S+)"

vnravikumar — Tue, 09 Aug 2022 13:18:00 GMT

@pavanae , you can try this