Splunk Search

How can I extract a complete field containing a comma?

garywiner
New Member

One of the fields in my data is the form "lastname,firstname". Splunk extracts the last name and moves on to the next field when it reaches the comma. I have tried to create a regex that seems to work in the online regex tester I use, but does not work in my rex clause.

Sample data:

blahdeblah;field21;field22;CallerName=IDAHO,DUNCAN;field24,field25;blahdeblahblah

I am NOT knowledgeable in regex, by any means, but this grabs more than the last name:

rex foo=_raw(?i)CallerName=(?P\S+)

but it produces nothing to look at in my table. Where did I go wrong? TIA

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your rex command doesn't put the matching text into a field so there's nothing in your table. The following rex command puts everything between 'CallerName=' and the following ';' into a field called 'name'.

rex "CallerName=(?P<name>[^;]+);"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

bchoi_splunk
Splunk Employee
Splunk Employee
| rex field=_raw "CallerName=(?<lastname>\w+),(?<firstname>\w+)" should do the trick. if you want to grab both, "CallerName=(?<Callername>\w+,\w+)"

richgalloway
SplunkTrust
SplunkTrust

Your rex command doesn't put the matching text into a field so there's nothing in your table. The following rex command puts everything between 'CallerName=' and the following ';' into a field called 'name'.

rex "CallerName=(?P<name>[^;]+);"
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...