One of the fields in my data is the form "lastname,firstname". Splunk extracts the last name and moves on to the next field when it reaches the comma. I have tried to create a regex that seems to work in the online regex tester I use, but does not work in my rex clause.
Sample data:
blahdeblah;field21;field22;CallerName=IDAHO,DUNCAN;field24,field25;blahdeblahblah
I am NOT knowledgeable in regex, by any means, but this grabs more than the last name:
rex foo=_raw(?i)CallerName=(?P\S+)
but it produces nothing to look at in my table. Where did I go wrong? TIA
Your rex command doesn't put the matching text into a field so there's nothing in your table. The following rex command puts everything between 'CallerName=' and the following ';' into a field called 'name'.
rex "CallerName=(?P<name>[^;]+);"
| rex field=_raw "CallerName=(?<lastname>\w+),(?<firstname>\w+)" should do the trick. if you want to grab both, "CallerName=(?<Callername>\w+,\w+)"
Your rex command doesn't put the matching text into a field so there's nothing in your table. The following rex command puts everything between 'CallerName=' and the following ';' into a field called 'name'.
rex "CallerName=(?P<name>[^;]+);"