Splunk Cloud Platform

rex syntax help

verifi81
Path Finder

Hi I have a search that his the Field of Username and 3 sample values

Username 
Bob Marley Peter,
Sammy Dolphin Green,
Larry Macy Jr,

I need help with the rex syntax that keeps the first and middle name separate, but joins the middle and last name while dropping the apostophe

In essence, i want the end result to be like this:

Username2
Bob MarleyPeter
Sammy DolphinGreen
Larry MacyJr


Please help correct this syntax:
| rex field=blah "(?i)username=(?<username2>[^,]+) | table username2

 

Labels (1)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Hi, you don't really need rex for that, although you could use rex with sed mode to achieve pretty much the same as this:

 

| eval Username2 = split(Username, " ")
| eval Username2 = mvindex(Username2, 0) . " " . mvjoin(mvindex(Username2,1,-1),"")

 

Screenshot from my lab:

 

Screenshot 2021-05-11 at 09.22.43.png

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, you don't really need rex for that, although you could use rex with sed mode to achieve pretty much the same as this:

 

| eval Username2 = split(Username, " ")
| eval Username2 = mvindex(Username2, 0) . " " . mvjoin(mvindex(Username2,1,-1),"")

 

Screenshot from my lab:

 

Screenshot 2021-05-11 at 09.22.43.png

View solution in original post

0 Karma

verifi81
Path Finder

Javiergn, thank you so much.

I forgot to add a .

What would I add to that to make the results look like this:

 

Username2
Bob.MarleyPeter
Sammy.DolphinGreen
Larry.MacyJr

0 Karma

verifi81
Path Finder

I figured it out. This will give me what I want

 

| eval Username2 = split(Username, " ")
| eval Username2 = mvindex(Username2, 0) . "." . mvjoin(mvindex(Username2,1,-1),"")


This is very complex.  Would you be kind enough to provide me a link that you would recommend a novice to study so that I can understand every aspect of the above command? 

 

0 Karma

javiergn
SplunkTrust
SplunkTrust

Sure no problem. The commands are actually relatively simple to understand:

split: https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/MultivalueEvalFunctions#split.28X...

mvindex: https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/MultivalueEvalFunctions#mvindex.2...

mvjoin: https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/MultivalueEvalFunctions#mvjoin.28...

 

In a nutshell, what the code above is doing is:

- Create field Username2 from splitting Username by blank spaces. Which creates a multivalue field (a field with several values, like an array)

- Then update Username2 by taking the first member of the this array with mvindex and join (using mvjoin) with all the remaining members of the array joined by "no space", (the double quotes). Which is the same as saying start at member 1 (remember that first member is 0) and then finish by member -1, which is the last one but without having to precalculate the length of your array.

This code will also work if your users have more than one middle or last name.

I hope that makes sense and if you are happy with the answer please don't forget to accept it as solution so that others can benefit from it.

0 Karma

verifi81
Path Finder

Thank you very much for taking the time to explain this to me.

0 Karma

javiergn
SplunkTrust
SplunkTrust
Sure no problem. If you were happy with the answers please don’t forget to upvote them and give karma so that others can find them more easily too. Regards, J
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.