Splunk Search

How do you use rex to slice a string up to the white space

madisonf15
Engager

I have a string called PGM_NM. The contents of PGM_NM are "AE248 \AX0\AX0". I want to use the rex function to slice the PGM_NM string to just be AE248. So essentially I want to slice the string up to the whitespace. Thanks!

Tags (2)
0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Hi madisonf15,

This should work:

<generating search> | rex field=PGM_NM "(?<value>[\S]+)\s.*"

Please let me know if this answers your question!

View solution in original post

somesoni2
Revered Legend

Other options

your base search | eval PGM_NM=mvindex(split,PGM_NM," "),0) 

your base search | eval PGM_NM=replace(PGM_NM,"^(\S+)(.*)","\1")
0 Karma

muebel
SplunkTrust
SplunkTrust

Hi madisonf15,

This should work:

<generating search> | rex field=PGM_NM "(?<value>[\S]+)\s.*"

Please let me know if this answers your question!

madisonf15
Engager

I used PGM_NM as the value and it worked perfectly. Thank you very much!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...