Splunk Search

I want to split a field into two different fields for comparison split at whitespace

jaleelahmed94
New Member

I want to split a field into two different fields for comparission,
my data is in the format:
address= 5555 xxxxx yyy Apt Z
desired result :
house number= 5555
street address = xxxx yyy

I have tried to use the split command but does not help me with what I want

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try rex.

... | rex field=address "(?<houseNumber>\d+)\s(?<streetAddress>.*)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

niketn
Legend

@jaleelahmed94, please try the following rex command:

<YourBaseSearch>
| table address
| rex field=address "address=\s(?<house_number>\d+)\s(?<street_address>.*)"

You can test the Regular Expression inside double quotes on regex101.com with your sample data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try rex.

... | rex field=address "(?<houseNumber>\d+)\s(?<streetAddress>.*)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

jaleelahmed94
New Member

Thanks, I was looking for something like this!

I instead used rex field=address "(?\s+)\s(?.*)"
because the address field was string.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...