Splunk Search

How to extract string before specific character

marinella26
Explorer

Hello. I want to extract strings anything comes before "|" .

ex.
Math |
Math | Science | Math
English | Math
Science | Science | Science | Science

Expected result:
Math
Math
English
Science

Below search did not worked.

my search | stats count by Subject="(?<Subject>[^\|]+)"

Please help me out.

 

Labels (7)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

you can use:

| rex "^(?<field>[^\|]+)"

that you can test at https://regex101.com/r/6Ynayk/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

you can use:

| rex "^(?<field>[^\|]+)"

that you can test at https://regex101.com/r/6Ynayk/1

Ciao.

Giuseppe

yuanliu
SplunkTrust
SplunkTrust

Read rex.  stats command doesn't have a function to do extraction.

Meanwhile, your sample code suggests that Splunk gives you a field named Subject and you are trying to get some info from this field.  If this is the case, there is a slightly more efficient way using split function:

my search
| Subject = mvindex(split(Subject, "|"), 0)
| stats count by Subject

Another way equivalent to rex is to use replace function.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...