Splunk Search

Splunk - retrieve nth word in a string

rupesh30n
Explorer

Hi,

How can I retrieve nth word in a string using rex or other alternatives?

For example:
"ABC BBC XYZ QAS"

"POP IMP RIL WER"

I want to extract XYZ and RIL here. Please note that they will always be the 3rd word but number of characters before them can vary.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

View solution in original post

lguinn2
Legend

Easy

yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"

rupesh30n
Explorer

Thanks MuS for a great suggestion.

0 Karma

MuS
SplunkTrust
SplunkTrust

try

| rex field=youroldfield "(\S+\s+){19}(?<yournewfield>\S+)\s"

this will match 19 times a group of any character that is not a whitespace character followed by spaces, the next match will be your 20th field 😉

rupesh30n
Explorer

Thanks Iguinn. That worked and you saved my day!!.

Is there a way we can generalize number of \S+\s+ instead of keep it adding to extract say 20th word?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...