I have a field names "code_value" which has the values as follows
code_value
ABC-123 JHLIK
ABC-456 LKJF
ABC-781 klklk
ABC-22 olsd
Now how do I extract the code_value field anything that comes before a space? something like below
new_field_derived_from_code_value
ABC-123
ABC-456
ABC-781
ABC-22
@pavanae , you can try this
| makeresults
| eval code_value ="ABC-123 JHLIK,
ABC-456 LKJF,
ABC-781 klklk,
ABC-22 olsd"
| makemv delim="," code_value
| mvexpand code_value
| eval result=mvindex(split(code_value," "),0)
For extracting a field from a field use the rex command. This regex puts everything up to the first space into the new field.
| rex field=code_value "(?<new_field_derived_from_code_value>\S+)"