how to split string in splunk

[Khushboo]

Hi @all,

i have following string which i want to break into there fields: service_name, host and port_id

metics-ha-5924590-011.aba.corp.tyos.com:2002

service_name = metics

host = ha-5924590-011.aba.corp.tyos.com

port = 2002
anyone please help me, how can i do it in splunk query.

Thanks !!

[gcusello]

Hi @Khushboo,

Please, try this regex:

| rex "(?<service_name>[^-]+)-(?<host>[^:]+):(?<port>\d+)"

tha you can test at https://regex101.com/r/wkUHCx/1

Ciao.

Giuseppe

[Khushboo]

Hi @gcusello ,

Thanks for your reply.
In my case all the variables like service_name, host and port are dynamic. so i cant hard-coded that.

[gcusello · Accepted solution]

Hi @Khushboo,

you have to define a rule to extract fields:

if you cadn define that:

• from the beginning to the first "-" it's the "service_name",
• from the service_name to ":" it's the host,
• after there's the port;

this regex can work.

In other words if you can define a rule, you can use a regex otherwise you cannot!

Ciao.

Giuseppe