topic I want to split a field into two different fields for comparison split at whitespace in Splunk Search

I want to split a field into two different fields for comparison split at whitespace

jaleelahmed94 — Fri, 27 Oct 2017 13:37:27 GMT

I want to split a field into two different fields for comparission,
my data is in the format:
address= 5555 xxxxx yyy Apt Z
desired result :
house number= 5555
street address = xxxx yyy

I have tried to use the split command but does not help me with what I want

Re: I want to split a field into two different fields for comparison split at whitespace

richgalloway — Fri, 27 Oct 2017 14:20:53 GMT

Try rex.

... | rex field=address "(?<houseNumber>\d+)\s(?<streetAddress>.*)" | ...

Re: I want to split a field into two different fields for comparison split at whitespace

niketn — Fri, 27 Oct 2017 14:23:18 GMT

@jaleelahmed94, please try the following rex command:

<YourBaseSearch>
| table address
| rex field=address "address=\s(?<house_number>\d+)\s(?<street_address>.*)"

You can test the Regular Expression inside double quotes on regex101.com with your sample data.

Re: I want to split a field into two different fields for comparison split at whitespace

jaleelahmed94 — Tue, 31 Oct 2017 15:30:54 GMT

Thanks, I was looking for something like this!

I instead used rex field=address "(?\s+)\s(?.*)"
because the address field was string.