Splunk Search

How do you make a regular expression to extract the first 4 words in a sentence?

dojiepreji
Path Finder

I need to extract the first 4 words in a field with sample data like this,

"The team performs checks for the following dashboards".

What I want is to extract the first 4 words, like so,

"The team performs checks".

rex field=long_description ^(?<field1>\w+\s\d+)

I've made a rex command that will extract the first word. However, I'm having difficulty figuring out how to extract the first 4 words.

Can anybody please help me out?

0 Karma
1 Solution

vnravikumar
Champion

Hi @dojiepreji

Please try

| makeresults 
| eval sample="The team performs checks for the following dashboards" 
| rex field=sample "(?P<output>(?:\S+\s){3}\S*).*"

View solution in original post

0 Karma

vnravikumar
Champion

Hi @dojiepreji

Please try

| makeresults 
| eval sample="The team performs checks for the following dashboards" 
| rex field=sample "(?P<output>(?:\S+\s){3}\S*).*"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you want the first 4 words in a single field or multiple fields. @saurabhkharkar's answer will put them into a single field. To get them in multiple fields, try this.

| rex field=long_description "(?<word1>\w+)\W+(?<word2>\w+)\W+(?<word3>\w+)\W+(?<word4>\w+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma

saurabhkharkar
Path Finder
|makeresults
|eval string="The team performs checks for the following dashboards"
| rex field=string "(?<output>\w+\s+\w+\s+\w+\s+\w+).+"
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...