Splunk Search

How to split data in a single cell?

MR1992
Explorer

I have the following data in a Cell that reads 

1.01.01 Example App AL11111

Is there a way I can split the data into 3 separate columns, there are no delimiters, I thought using space but I have entries that do have spaces in the middle section.

e.g. 

1.1.1.10 Example App AL11111

 

One thing to note, the initial numbers will always be 8 characters long and the AL***** will always be 7 characters

Thanks

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your initial example only has 7 characters in the first part, so this would work

 

| rex "(?<field1>[^\s]+)\s(?<field2>.*)\s(?<field3>[^\s]*)"

 

If you want to be more strict, try this

| rex "(?<field1>[^\s]{8})\s(?<field2>.*)\s(?<field3>[^\s]{7})"

View solution in original post

MR1992
Explorer

This worked perfectly, thank you

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your initial example only has 7 characters in the first part, so this would work

 

| rex "(?<field1>[^\s]+)\s(?<field2>.*)\s(?<field3>[^\s]*)"

 

If you want to be more strict, try this

| rex "(?<field1>[^\s]{8})\s(?<field2>.*)\s(?<field3>[^\s]{7})"
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...