Splunk Cloud Platform

expression to capture all the delimiters and replace with space

Splunkerninja
Path Finder

Hi,

 

I have to replace all the possible delimiters in the field with space so that I capture each word separately.

Example: 5bb2a5-bb04-460e-a7bc-abb95d07a13_Setgfub.jpg I need to remove the extension as well it could be anything so .csv or .xslx or .do

I need the output as below
5bb2a8d5

bb04

460e

a7bc

bb995d07a13

Setgfub

 

I came up with expression which works fine but i need this either in regular expression or eval expression as I am using it for data model.

 

 

| makeresults 
| eval test="ton-o-mete_r v4.pdf" 
| rex field=test mode=sed "s/\-|\_|\.|\(|\)|\,|\;/ /g"
| eval temp=split('test'," "

 

 

 

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this rex command.  It extracts the individual fields directly.

| makeresults 
| eval test="ton-o-mete_r v4.pdf" 
| rex field=test max_match=0 "(?<temp>[^\-_\.\(\),;\s]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...