topic How to extract string before specific character in Splunk Search

How to extract string before specific character

marinella26 — Wed, 12 Jul 2023 08:07:06 GMT

Hello. I want to extract strings anything comes before "|" .

Expected result:
Math
Math
English
Science

Below search did not worked.

my search | stats count by Subject="(?<Subject>[^\|]+)"

Please help me out.

Re: How to extract string before specific character

yuanliu — Wed, 12 Jul 2023 08:26:17 GMT

Read rex. stats command doesn't have a function to do extraction.

Meanwhile, your sample code suggests that Splunk gives you a field named Subject and you are trying to get some info from this field. If this is the case, there is a slightly more efficient way using split function:

my search | Subject = mvindex(split(Subject, "|"), 0) | stats count by Subject

Another way equivalent to rex is to use replace function.

Re: How to extract string before specific character

gcusello — Wed, 12 Jul 2023 08:33:43 GMT

Hi @marinella26 ,

you can use:

| rex "^(?<field>[^\|]+)"

that you can test at https://regex101.com/r/6Ynayk/1

Ciao.

Giuseppe