Splunk Search

How do I extract a new field from a table?

New Member

Hi, I extracted a field and am viewing it in a table. But some data has a comma (,) in between. I want to create a new column without the comma ** and whatever comes **after the comma should not be there in that field.

please help me to come up with a solution!

Tags (2)
0 Karma
1 Solution

Esteemed Legend

Add this to your existing search:

... | rex field=YourExistingFieldName "^(?<YourNewFieldName>[^#]+)"

View solution in original post

0 Karma

Esteemed Legend

Add this to your existing search:

... | rex field=YourExistingFieldName "^(?<YourNewFieldName>[^#]+)"

View solution in original post

0 Karma

New Member

Hi woodcock,
I want it should get split only alphabets followed by a #, if a space is followed by a #. then i don't want to. can you please help me to do it

0 Karma

Esteemed Legend

Like this:
... | rex field=YourExistingFieldName "^(?[^#\s]+)"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!