Splunk - retrieve nth word in a string

[rupesh30n]

Hi,

How can I retrieve nth word in a string using rex or other alternatives?

For example:
"ABC BBC XYZ QAS"

"POP IMP RIL WER"

I want to extract XYZ and RIL here. Please note that they will always be the 3rd word but number of characters before them can vary.

[lguinn2 · Accepted solution]

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

[rupesh30n]

Thanks MuS for a great suggestion.

[MuS]

try

| rex field=youroldfield "(\S+\s+){19}(?<yournewfield>\S+)\s"

this will match 19 times a group of any character that is not a whitespace character followed by spaces, the next match will be your 20th field 😉

[rupesh30n]

Thanks Iguinn. That worked and you saved my day!!.

Is there a way we can generalize number of \S+\s+ instead of keep it adding to extract say 20th word?