How to extract only first word from a field value?

[sashib]

Hi

I need to extract only name values (first word value eg:james) from the below Name filed

I tried with  rex field=Name mode=sed "s/\W+\s\w.*//g" but not working

Name

james buildingA

jack buildingB firstfloor

Can you please help me with this.

[gcusello]

Hi @sashib,

let me understand: you want to extract the first word of a field (called e.g. "your_field") and put it into a field called Name, is it correct?

If this is you need, please try this:

| rex field=your_field "^(?<name>\w*)"

you can test the regex at https://regex101.com/r/9YZSF6/1

Ciao.

Giuseppe

[ITWhisperer]

| rex field=Name mode=sed "s/\W.*//g"

[sashib]

 @ITWhisperer I am not getting any results with this. Looks like it is replacing complete field value with Null/empty value

[ITWhisperer]

It works with the example you provided - perhaps this wasn't an accurate enough representation of your events. The rex assumes that the very first character of the field is a letter or number as it replaces from the first non-letter/number (\W) onwards. Try it this way (which replaces from the first "space" onwards)

| rex field=Name mode=sed "s/\s.*//g"