Splunk Search

How to divide field value to 2 fields?

ednk
Explorer

Hi 

I requested to exclude 2 values from one field value.

I mean for each event I have "file_name", that written in the same shape.

the city is first, and than the tool, so i want to extract these value for each event

file_name city tool
montreal - tool3 - SFR - Alert ID 123456 - (3 May 2022 01:20:24 IDT) montreal tool3
Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'd use rex.

| rex field=file_name "(?<city>\S+)\s*-\s*(?<tool>\S+)"

The regex may need to be adjusted depending on the expected values for city and tool.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'd use rex.

| rex field=file_name "(?<city>\S+)\s*-\s*(?<tool>\S+)"

The regex may need to be adjusted depending on the expected values for city and tool.

 

---
If this reply helps you, Karma would be appreciated.

ednk
Explorer

thanks!

and how can  I extract the time "3 May 2022 01:20:24" ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's easy to do with a separate rex command.

| rex field=file_name "\((?<timestamp>[^\)]+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...