Splunk Search

extract text using regex

moayadalghamdi
Path Finder

hi, i want to extracted the first word from each variable the index has a field called search_name which has these variables:

 

Risk - 24 Hour Risk Threshold Exceeded - Rule
Endpoint - machine with possible malware - fffff
Network - Possible SQL injection - Rule

 

i want to perform a regex to extracted the first word out of each variable so the output would be:

 

risk

endpoint

network

 

 

 

 

thanks ^_^

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @moayadalghamdi,

please try this regex

| rex "^(?<your_field>\w+)"

that you can test at https://regex101.com/r/vKZmWL/1

Ciao.

Giuseppe

View solution in original post

moayadalghamdi
Path Finder

thanks for the answer ^_^

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @moayadalghamdi,

please try this regex

| rex "^(?<your_field>\w+)"

that you can test at https://regex101.com/r/vKZmWL/1

Ciao.

Giuseppe

moayadalghamdi
Path Finder

you're really a legend, thanks mate splunker ^_^

0 Karma

isoutamo
SplunkTrust
SplunkTrust

And as you want those with lower cases then add this

| makeresults
| eval _raw ="Risk - 24 Hour Risk Threshold Exceeded - Rule
Endpoint - machine with possible malware - fffff
Network - Possible SQL injection - Rule"
| multikv noheader=t 
``` Above create test data ```
| rex "^(?<result>\w+)"
| eval res = lower(result)
| table res result _raw

r. Ismo 

Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...