How to use substr to extract the first character of a string and keep all characters up until the first space character?

[bhicks32]

I have a string nadcwppcxicc01x CPU Usage has exceeded the threshold for 30 minutes &I where I would like to create a new column and extract from the string where it would show nadcwppcxicc01x only. I know this would be possible using substr(tablename,1,15), however, I have other strings that differ in length.

Any help would be appreciated!

[jbjerke_splunk · Accepted solution]

Hi bhicks32

Use the "rex" command. It's much more flexible than substr.

For this string it would look like this:

 YOURSEARCH | rex field=YOURFIELD "(?<NEWFIELD>[^\s]+)"

If you are not entirely familiar with regex I can recommend this site as a reference:

http://regexr.com/

If this works, please mark as answered.

j