Splunk Search

How to divide field value to 2 fields?

ednk
Explorer

Hi 

I requested to exclude 2 values from one field value.

I mean for each event I have "file_name", that written in the same shape.

the city is first, and than the tool, so i want to extract these value for each event

file_name city tool
montreal - tool3 - SFR - Alert ID 123456 - (3 May 2022 01:20:24 IDT) montreal tool3
Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'd use rex.

| rex field=file_name "(?<city>\S+)\s*-\s*(?<tool>\S+)"

The regex may need to be adjusted depending on the expected values for city and tool.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'd use rex.

| rex field=file_name "(?<city>\S+)\s*-\s*(?<tool>\S+)"

The regex may need to be adjusted depending on the expected values for city and tool.

 

---
If this reply helps you, Karma would be appreciated.

ednk
Explorer

thanks!

and how can  I extract the time "3 May 2022 01:20:24" ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's easy to do with a separate rex command.

| rex field=file_name "\((?<timestamp>[^\)]+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...