topic how to extract first word from the given format. . in Splunk Search

how to extract first word from the given format. .

kavyatim — Fri, 02 May 2014 08:30:13 GMT

Hi ,

I have following values:
Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6,

D-LINK DSL-500B Geracao II,

COMTREND-COMTREND CT-5072S ,
I need to extract only first word like:Thomson,D-LINK,COMTREND.Can any one help me in writing regex to this.

Re: how to extract first word from the given format. .

MuS — Fri, 02 May 2014 09:59:12 GMT

Hi kavyatim,

if the needed words are always the first words at the start of a new line, use this:

... | rex "^(?<myField>\w+(\s|-LINK|))" | table myField

This will get you a table of

Thomson
D-LINK
COMTREND

hope this helps ...

cheers, MuS

Re: how to extract first word from the given format. .

harshavrath — Fri, 02 May 2014 10:10:21 GMT

This might be helpful

http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/ExtractfieldsinteractivelywithIFX

this is the link for Automatic generation of rex

Watch this video

http://www.splunk.com/view/SP-CAAADUY

Re: how to extract first word from the given format. .

martin_mueller — Fri, 02 May 2014 16:24:30 GMT

It's a bit ugly to have the dash sometimes be part of the word (D-LINK) and sometimes serve as a word separator (COMTREND-COMTREND) - if your list of such exceptions is large then you'll have to build a large regex.