How to split a field into two different fields using eval in Splunk?

[pavanae]

I have a field as follows in the logs 

user="userAbc1 (host1234)"

As you can see both the username and hostname fields are together in the user field. Now how do I apply regex and separate both the fields into 2 corresponding fields as follows 

user=userAbc1

host=host1234

[richgalloway]

Try this rex command.

| rex field=foo "(?<user>\S+)\s\((?<host>=[^\(]+)"

[gcusello · Accepted solution]

Hi @pavanae.

please try this:

| rex field=user "^(?<user>.*)\s+\((?<host>[^\)]*)\)"

Ciao.

Giuseppe

[gcusello]

Hi @pavanae ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉