Splunk Search

Extract sub string from address

sndpgiri
Engager

I have the following address, and I want to extract the substring.

Address: 121, riverstreet, sydney, Australia.

I want to extract 'sydney'.

Help would be highly appreciated.

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you already have the Address in a field called Address

| eval city=mvindex(split(Address,","),3)

or

| rex field=Address "([^,]+,){2}(?<city>[^,]+)"

Otherwise, use

| rex "Address:\s([^,]+,){2}(?<city>[^,]+)"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!