Splunk Search

Extract a field from a field in splunk?

pavanae
Builder

I have a field names "code_value" which has the values as follows 

 

code_value
ABC-123 JHLIK
ABC-456 LKJF
ABC-781 klklk
ABC-22 olsd

 

Now how do I extract the code_value field anything that comes before a space? something like below 

new_field_derived_from_code_value
ABC-123 
ABC-456 
ABC-781 
ABC-22 
Labels (1)
Tags (2)
0 Karma

vnravikumar
Champion

@pavanae , you can try this

| makeresults 
| eval code_value ="ABC-123 JHLIK,
ABC-456 LKJF,
ABC-781 klklk,
ABC-22 olsd" 
| makemv delim="," code_value 
| mvexpand code_value 
| eval result=mvindex(split(code_value," "),0)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

For extracting a field from a field use the rex command.  This regex puts everything up to the first space into the new field.

| rex field=code_value "(?<new_field_derived_from_code_value>\S+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...