How to write regex to represent only first part of value?

[mark_groenveld]

I have a key:value for db names but need only the first part.

Example

Current
DBNAME : db001_inst1:schemanamexyx
Or
DBNAME : db01_inst1:schemanamexyx

Requested
REX statement to provide only the values in front of the colon.  I.E., db001_inst1 or db01_inst1

[gcusello]

Hi @mark_groenveld,

you could try this regex

| rex ":\s+(?<your_field>[^:]+)"

that you can test at https://regex101.com/r/pj1bQO/1

Ciao.

Giuseppe

[richgalloway · Accepted solution]

It would help to know what you've tried already.

Try this

| rex field=db_name "(?<key>[^:]+)"

Be sure to change "db_name" to name of the field containing the key:value.  Don't use _raw or this won't work.

[mark_groenveld]

Thanks Rich for the solution.

[gcusello]

Hi @mark_groenveld,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉