Splunk Search

I want to split a field into two different fields for comparison split at whitespace

New Member

I want to split a field into two different fields for comparission,
my data is in the format:
address= 5555 xxxxx yyy Apt Z
desired result :
house number= 5555
street address = xxxx yyy

I have tried to use the split command but does not help me with what I want

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try rex.

... | rex field=address "(?<houseNumber>\d+)\s(?<streetAddress>.*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@jaleelahmed94, please try the following rex command:

<YourBaseSearch>
| table address
| rex field=address "address=\s(?<house_number>\d+)\s(?<street_address>.*)"

You can test the Regular Expression inside double quotes on regex101.com with your sample data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

Try rex.

... | rex field=address "(?<houseNumber>\d+)\s(?<streetAddress>.*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Thanks, I was looking for something like this!

I instead used rex field=address "(?\s+)\s(?.*)"
because the address field was string.

0 Karma