Splunk Search

How to extract only first word from a field value?

sashib
Explorer

Hi

I need to extract only name values (first word value eg:james) from the below Name filed

I tried with  rex field=Name mode=sed "s/\W+\s\w.*//g" but not working

Name

james buildingA

jack buildingB firstfloor

 

Can you please help me with this.

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sashib,

let me understand: you want to extract the first word of a field (called e.g. "your_field") and put it into a field called Name, is it correct?

If this is you need, please try this:

| rex field=your_field "^(?<name>\w*)"

you can test the regex at https://regex101.com/r/9YZSF6/1

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name mode=sed "s/\W.*//g"
0 Karma

sashib
Explorer

 @ITWhisperer I am not getting any results with this. Looks like it is replacing complete field value with Null/empty value

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It works with the example you provided - perhaps this wasn't an accurate enough representation of your events. The rex assumes that the very first character of the field is a letter or number as it replaces from the first non-letter/number (\W) onwards. Try it this way (which replaces from the first "space" onwards)

| rex field=Name mode=sed "s/\s.*//g"
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...