Splunk Search

Splunk - retrieve nth word in a string

rupesh30n
Explorer

Hi,

How can I retrieve nth word in a string using rex or other alternatives?

For example:
"ABC BBC XYZ QAS"

"POP IMP RIL WER"

I want to extract XYZ and RIL here. Please note that they will always be the 3rd word but number of characters before them can vary.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

View solution in original post

lguinn2
Legend

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

rupesh30n
Explorer

Thanks MuS for a great suggestion.

0 Karma

MuS
Legend

try

| rex field=youroldfield "(\S+\s+){19}(?<yournewfield>\S+)\s"

this will match 19 times a group of any character that is not a whitespace character followed by spaces, the next match will be your 20th field 😉

rupesh30n
Explorer

Thanks Iguinn. That worked and you saved my day!!.

Is there a way we can generalize number of \S+\s+ instead of keep it adding to extract say 20th word?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...