Splunk Search

How to extract only first word from a field value?

sashib
Explorer

Hi

I need to extract only name values (first word value eg:james) from the below Name filed

I tried with  rex field=Name mode=sed "s/\W+\s\w.*//g" but not working

Name

james buildingA

jack buildingB firstfloor

 

Can you please help me with this.

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sashib,

let me understand: you want to extract the first word of a field (called e.g. "your_field") and put it into a field called Name, is it correct?

If this is you need, please try this:

| rex field=your_field "^(?<name>\w*)"

you can test the regex at https://regex101.com/r/9YZSF6/1

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name mode=sed "s/\W.*//g"
0 Karma

sashib
Explorer

 @ITWhisperer I am not getting any results with this. Looks like it is replacing complete field value with Null/empty value

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It works with the example you provided - perhaps this wasn't an accurate enough representation of your events. The rex assumes that the very first character of the field is a letter or number as it replaces from the first non-letter/number (\W) onwards. Try it this way (which replaces from the first "space" onwards)

| rex field=Name mode=sed "s/\s.*//g"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...