Splunk Search

Splunk - retrieve nth word in a string

rupesh30n
Explorer

Hi,

How can I retrieve nth word in a string using rex or other alternatives?

For example:
"ABC BBC XYZ QAS"

"POP IMP RIL WER"

I want to extract XYZ and RIL here. Please note that they will always be the 3rd word but number of characters before them can vary.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

View solution in original post

lguinn2
Legend

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

rupesh30n
Explorer

Thanks MuS for a great suggestion.

0 Karma

MuS
SplunkTrust
SplunkTrust

try

| rex field=youroldfield "(\S+\s+){19}(?<yournewfield>\S+)\s"

this will match 19 times a group of any character that is not a whitespace character followed by spaces, the next match will be your 20th field 😉

rupesh30n
Explorer

Thanks Iguinn. That worked and you saved my day!!.

Is there a way we can generalize number of \S+\s+ instead of keep it adding to extract say 20th word?

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...