I have a file called "HelpDeskUsers"
I would like to remove the names from the end of the field.
HelpDesk Users 134-ABC-HelpDesk-Admins Joe 127-ABC-HelpDesk-Admins Mary 178-ABC-HelpDesk-Admins Daniel 189-ABC-HelpDesk-Admins Eva 139-ABC-HelpDesk-Admins Alan Results: HelpDesk Users 134-ABC-HelpDesk-Admins 127-ABC-HelpDesk-Admins 178-ABC-HelpDesk-Admins 189-ABC-HelpDesk-Admins 139-ABC-HelpDesk-Admins
| rex field=HelpDeskUsers "(?<HelpDeskUsers>^[^\s]*)"
| splunk command
rex applied to
field=fieldname quote paren
"( to start the regex capture and name the new field
^[^\s]* quote paren to close
i like this book to help with regex https://www.amazon.com/Teach-Yourself-Regular-Expressions-Minutes/dp/0672325667
If what you're after is everything before the first space character, this should work:
... | eval HelpDeskUsers=mvindex(split(HelpDeskUsers," "),0)
That is, make a multivalue field out of
HelpDeskUsers by splitting it on space characters, then grab the first entry in the newly created multivalue field.