Splunk Search

How to extract only first word from a field value?

sashib
Explorer

Hi

I need to extract only name values (first word value eg:james) from the below Name filed

I tried with  rex field=Name mode=sed "s/\W+\s\w.*//g" but not working

Name

james buildingA

jack buildingB firstfloor

 

Can you please help me with this.

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sashib,

let me understand: you want to extract the first word of a field (called e.g. "your_field") and put it into a field called Name, is it correct?

If this is you need, please try this:

| rex field=your_field "^(?<name>\w*)"

you can test the regex at https://regex101.com/r/9YZSF6/1

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name mode=sed "s/\W.*//g"
0 Karma

sashib
Explorer

 @ITWhisperer I am not getting any results with this. Looks like it is replacing complete field value with Null/empty value

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It works with the example you provided - perhaps this wasn't an accurate enough representation of your events. The rex assumes that the very first character of the field is a letter or number as it replaces from the first non-letter/number (\W) onwards. Try it this way (which replaces from the first "space" onwards)

| rex field=Name mode=sed "s/\s.*//g"
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...