topic Re: How to use substr to extract the first character of a string and keep all characters up until the first space character? in Splunk Search

How to use substr to extract the first character of a string and keep all characters up until the first space character?

bhicks32 — Thu, 28 Jan 2016 22:19:10 GMT

I have a string nadcwppcxicc01x CPU Usage has exceeded the threshold for 30 minutes &I where I would like to create a new column and extract from the string where it would show nadcwppcxicc01x only. I know this would be possible using substr(tablename,1,15), however, I have other strings that differ in length.

Any help would be appreciated!

Re: How to use substr to extract the first character of a string and keep all characters up until the first space character?

jbjerke_splunk — Thu, 28 Jan 2016 23:56:59 GMT

Hi bhicks32

Use the "rex" command. It's much more flexible than substr.

For this string it would look like this:

 YOURSEARCH | rex field=YOURFIELD "(?<NEWFIELD>[^\s]+)"

If you are not entirely familiar with regex I can recommend this site as a reference:

http://regexr.com/

If this works, please mark as answered.