Splunk Search

rex

Deku2345
Observer

How to split a text like ""Liam John" "Grayson Roy" "Olivia"" into names filed using eval and text.

names:

Liam John
Grayson Roy
Olivia

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Deku2345,

you can use the rex command, something like this:

| rex "\"(?<last_name>[^ \"]+)\s|\"(?<first_name>[^ \"]+)"

that you can test at https://regex101.com/r/LYEhns/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Platform | Upgrading your Splunk Deployment to Python 3.9

Splunk initially announced the removal of Python 2 during the release of Splunk Enterprise 8.0.0, aiming to ...

From Product Design to User Insights: Boosting App Developer Identity on Splunkbase

co-authored by Yiyun Zhu & Dan Hosaka Engaging with the Community at .conf24 At .conf24, we revitalized the ...

Detect and Resolve Issues in a Kubernetes Environment

We’ve gone through common problems one can encounter in a Kubernetes environment, their impacts, and the ...