topic Re: how to split a field into 2 different fields using eval in Splunk? in Splunk Search

How to split a field into two different fields using eval in Splunk?

pavanae — Mon, 15 May 2023 12:54:52 GMT

I have a field as follows in the logs

user="userAbc1 (host1234)"

As you can see both the username and hostname fields are together in the user field. Now how do I apply regex and separate both the fields into 2 corresponding fields as follows

user=userAbc1

host=host1234

Re: how to split a field into 2 different fields using eval in Splunk?

gcusello — Fri, 12 May 2023 14:03:34 GMT

Hi @pavanae.

please try this:

| rex field=user "^(?<user>.*)\s+\((?<host>[^\)]*)\)"

Ciao.

Giuseppe

Re: how to split a field into 2 different fields using eval in Splunk?

richgalloway — Fri, 12 May 2023 14:07:18 GMT

Try this rex command.

| rex field=foo "(?<user>\S+)\s\((?<host>=[^\(]+)"

Re: how to split a field into 2 different fields using eval in Splunk?

gcusello — Fri, 12 May 2023 14:51:15 GMT

Hi @pavanae ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉