rex - Splunk Community

Splunk Search

How to split a text like ""Liam John" "Grayson Roy" "Olivia"" into names filed using eval and text.

names:

Liam John
Grayson Roy
Olivia

you can use the rex command, something like this:

| rex "\"(?<last_name>[^ \"]+)\s|\"(?<first_name>[^ \"]+)"

that you can test at https://regex101.com/r/LYEhns/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...