topic Re: Function to fetch a part of a field value in Splunk Search

Function to fetch a part of a field value

Jananee_iNautix — Wed, 29 Jan 2014 07:40:13 GMT

A field called username has values
INPUT:
kesia@abc.bgf.hf:123
gefuf@ef.eff.gre:872
.I want to take the string before the @ symbol alone like
OUTPUT:
kesis
gefuf

How can this be done in splunk and Which function will be apt to this requirement?

Re: Function to fetch a part of a field value

hRun — Wed, 29 Jan 2014 07:48:14 GMT

Is the username field a multivalue field or did you just provide two examples for possible values?
And are you referring to an extraction at search time or at indexing time (field extraction)?

Re: Function to fetch a part of a field value

MuS — Wed, 29 Jan 2014 07:49:13 GMT

Hi Jananee_iNautix,

based on the provided information, you can use rex to do this in search time like this:

YorFancySearch | rex field=username "\s(?<username>.*)\@" | ....

If you want that field to be extracted at index time, use the this guide

hope this helps ...

cheers, MuS

Re: Function to fetch a part of a field value

Jananee_iNautix — Wed, 29 Jan 2014 08:31:07 GMT

At search time only.i extracted the field username which has sample values i specified.i want to extract a part of that field value

Re: Function to fetch a part of a field value

Jananee_iNautix — Wed, 29 Jan 2014 08:37:17 GMT

i don want to extract it like you said.Using functions i want to take kesia alone from the value kesia@abc.bgf.hf:123 named as a field username

Re: Function to fetch a part of a field value

somesoni2 — Wed, 29 Jan 2014 23:15:45 GMT

small correction here in rex. Field name extracted with @ is username.

your base search..| rex field=username "(?.*)@"