Hi
I need to extract only name values (first word value eg:james) from the below Name filed
I tried with rex field=Name mode=sed "s/\W+\s\w.*//g" but not working
Name
james buildingA
jack buildingB firstfloor
Can you please help me with this.
Hi @sashib,
let me understand: you want to extract the first word of a field (called e.g. "your_field") and put it into a field called Name, is it correct?
If this is you need, please try this:
| rex field=your_field "^(?<name>\w*)"
you can test the regex at https://regex101.com/r/9YZSF6/1
Ciao.
Giuseppe
| rex field=Name mode=sed "s/\W.*//g"
@ITWhisperer I am not getting any results with this. Looks like it is replacing complete field value with Null/empty value
It works with the example you provided - perhaps this wasn't an accurate enough representation of your events. The rex assumes that the very first character of the field is a letter or number as it replaces from the first non-letter/number (\W) onwards. Try it this way (which replaces from the first "space" onwards)
| rex field=Name mode=sed "s/\s.*//g"