Splunk Search

How to extract only first word from a field value?

sashib
Explorer

Hi

I need to extract only name values (first word value eg:james) from the below Name filed

I tried with  rex field=Name mode=sed "s/\W+\s\w.*//g" but not working

Name

james buildingA

jack buildingB firstfloor

 

Can you please help me with this.

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sashib,

let me understand: you want to extract the first word of a field (called e.g. "your_field") and put it into a field called Name, is it correct?

If this is you need, please try this:

| rex field=your_field "^(?<name>\w*)"

you can test the regex at https://regex101.com/r/9YZSF6/1

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name mode=sed "s/\W.*//g"
0 Karma

sashib
Explorer

 @ITWhisperer I am not getting any results with this. Looks like it is replacing complete field value with Null/empty value

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It works with the example you provided - perhaps this wasn't an accurate enough representation of your events. The rex assumes that the very first character of the field is a letter or number as it replaces from the first non-letter/number (\W) onwards. Try it this way (which replaces from the first "space" onwards)

| rex field=Name mode=sed "s/\s.*//g"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...