Extract a field from a field in splunk?

[pavanae]

I have a field names "code_value" which has the values as follows 

code_value
ABC-123 JHLIK
ABC-456 LKJF
ABC-781 klklk
ABC-22 olsd

Now how do I extract the code_value field anything that comes before a space? something like below 

new_field_derived_from_code_value
ABC-123 
ABC-456 
ABC-781 
ABC-22 

[vnravikumar]

@pavanae , you can try this

| makeresults 
| eval code_value ="ABC-123 JHLIK,
ABC-456 LKJF,
ABC-781 klklk,
ABC-22 olsd" 
| makemv delim="," code_value 
| mvexpand code_value 
| eval result=mvindex(split(code_value," "),0)

[richgalloway]

For extracting a field from a field use the rex command.  This regex puts everything up to the first space into the new field.

| rex field=code_value "(?<new_field_derived_from_code_value>\S+)"