Splunk Search

How can I extract a complete field containing a comma?

garywiner
New Member

One of the fields in my data is the form "lastname,firstname". Splunk extracts the last name and moves on to the next field when it reaches the comma. I have tried to create a regex that seems to work in the online regex tester I use, but does not work in my rex clause.

Sample data:

blahdeblah;field21;field22;CallerName=IDAHO,DUNCAN;field24,field25;blahdeblahblah

I am NOT knowledgeable in regex, by any means, but this grabs more than the last name:

rex foo=_raw(?i)CallerName=(?P\S+)

but it produces nothing to look at in my table. Where did I go wrong? TIA

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your rex command doesn't put the matching text into a field so there's nothing in your table. The following rex command puts everything between 'CallerName=' and the following ';' into a field called 'name'.

rex "CallerName=(?P<name>[^;]+);"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

bchoi_splunk
Splunk Employee
Splunk Employee
| rex field=_raw "CallerName=(?<lastname>\w+),(?<firstname>\w+)" should do the trick. if you want to grab both, "CallerName=(?<Callername>\w+,\w+)"

richgalloway
SplunkTrust
SplunkTrust

Your rex command doesn't put the matching text into a field so there's nothing in your table. The following rex command puts everything between 'CallerName=' and the following ';' into a field called 'name'.

rex "CallerName=(?P<name>[^;]+);"
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...