How to divide field value to 2 fields?

[ednk]

Hi 

I requested to exclude 2 values from one field value.

I mean for each event I have "file_name", that written in the same shape.

the city is first, and than the tool, so i want to extract these value for each event

file_name	city	tool
montreal - tool3 - SFR - Alert ID 123456 - (3 May 2022 01:20:24 IDT)	montreal	tool3

[richgalloway · Accepted solution]

I'd use rex.

| rex field=file_name "(?<city>\S+)\s*-\s*(?<tool>\S+)"

The regex may need to be adjusted depending on the expected values for city and tool.

[ednk]

thanks!

and how can  I extract the time "3 May 2022 01:20:24" ?

[richgalloway]

That's easy to do with a separate rex command.

| rex field=file_name "\((?<timestamp>[^\)]+)"