Splunk Search

Extract a field from a field in splunk?

pavanae
Builder

I have a field names "code_value" which has the values as follows 

 

code_value
ABC-123 JHLIK
ABC-456 LKJF
ABC-781 klklk
ABC-22 olsd

 

Now how do I extract the code_value field anything that comes before a space? something like below 

new_field_derived_from_code_value
ABC-123 
ABC-456 
ABC-781 
ABC-22 
Labels (1)
Tags (2)
0 Karma

vnravikumar
Champion

@pavanae , you can try this

| makeresults 
| eval code_value ="ABC-123 JHLIK,
ABC-456 LKJF,
ABC-781 klklk,
ABC-22 olsd" 
| makemv delim="," code_value 
| mvexpand code_value 
| eval result=mvindex(split(code_value," "),0)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

For extracting a field from a field use the rex command.  This regex puts everything up to the first space into the new field.

| rex field=code_value "(?<new_field_derived_from_code_value>\S+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...