extract text using regex

[moayadalghamdi]

hi, i want to extracted the first word from each variable the index has a field called search_name which has these variables:

Risk - 24 Hour Risk Threshold Exceeded - Rule
Endpoint - machine with possible malware - fffff
Network - Possible SQL injection - Rule

i want to perform a regex to extracted the first word out of each variable so the output would be:

risk

endpoint

network

thanks ^_^

[moayadalghamdi]

thanks for the answer ^_^

[gcusello · Accepted solution]

Hi @moayadalghamdi,

please try this regex

| rex "^(?<your_field>\w+)"

that you can test at https://regex101.com/r/vKZmWL/1

Ciao.

Giuseppe

[moayadalghamdi]

you're really a legend, thanks mate splunker ^_^

[isoutamo]

And as you want those with lower cases then add this

| makeresults
| eval _raw ="Risk - 24 Hour Risk Threshold Exceeded - Rule
Endpoint - machine with possible malware - fffff
Network - Possible SQL injection - Rule"
| multikv noheader=t 
``` Above create test data ```
| rex "^(?<result>\w+)"
| eval res = lower(result)
| table res result _raw

r. Ismo