Splunk Search

how to extract first word from the given format. .

kavyatim
Path Finder

Hi ,

I have following values:
Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6,

D-LINK DSL-500B Geracao II,

COMTREND-COMTREND CT-5072S ,
I need to extract only first word like:Thomson,D-LINK,COMTREND.Can any one help me in writing regex to this.

Tags (1)
0 Karma

harshavrath
Contributor

This might be helpful

http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/ExtractfieldsinteractivelywithIFX

this is the link for Automatic generation of rex

Watch this video

http://www.splunk.com/view/SP-CAAADUY

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi kavyatim,

if the needed words are always the first words at the start of a new line, use this:

... | rex "^(?<myField>\w+(\s|-LINK|))" | table myField

This will get you a table of

  • Thomson
  • D-LINK
  • COMTREND

hope this helps ...

cheers, MuS

martin_mueller
SplunkTrust
SplunkTrust

It's a bit ugly to have the dash sometimes be part of the word (D-LINK) and sometimes serve as a word separator (COMTREND-COMTREND) - if your list of such exceptions is large then you'll have to build a large regex.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...