Splunk Search

How to use substr to extract the first character of a string and keep all characters up until the first space character?

bhicks32
Explorer

I have a string nadcwppcxicc01x CPU Usage has exceeded the threshold for 30 minutes &I where I would like to create a new column and extract from the string where it would show nadcwppcxicc01x only. I know this would be possible using substr(tablename,1,15), however, I have other strings that differ in length.

Any help would be appreciated!

0 Karma
1 Solution

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi bhicks32

Use the "rex" command. It's much more flexible than substr.

For this string it would look like this:

 YOURSEARCH | rex field=YOURFIELD "(?<NEWFIELD>[^\s]+)"

If you are not entirely familiar with regex I can recommend this site as a reference:

http://regexr.com/

If this works, please mark as answered.

j

View solution in original post

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi bhicks32

Use the "rex" command. It's much more flexible than substr.

For this string it would look like this:

 YOURSEARCH | rex field=YOURFIELD "(?<NEWFIELD>[^\s]+)"

If you are not entirely familiar with regex I can recommend this site as a reference:

http://regexr.com/

If this works, please mark as answered.

j

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...