How to remove a word with Regex using Capturing group?

[poojithavasanth]

Hello,

I have a Regex for splitting a Person full name into Person lastname, firstname and middlename.

Regex used: (?<prsnl_last>\w+)([\s]*(?<prsnl_credentials>[\w]*)|)[\s]*,[\s]*(?<prsnl_first>\w+)([\s]*(?<prsnl_middle>[\w]+.*?)|)

Now I would need to remove prsnl_last from the output. (Basically, to scrub the data from prsnl_last event)

Output should be something like this. "Haikal" and "Campbeli" should be removed.

Can someone please help me out?

Thank you!

[ITWhisperer]

Can you declare it as a non-capture group?

(?:\w+)([\s]*(?<prsnl_credentials>[\w]*)|)[\s]*,[\s]*(?<prsnl_first>\w+)([\s]*(?<prsnl_middle>[\w]+.*?)|)

[poojithavasanth]

This Regex works! Thank you @ITWhisperer 

Just checking if we can create a Regex using a capturing group<prsnl_last> and then to remove the data within it?

So that the first word assigns to <prsnl_last>, but the value would be null.

[ITWhisperer]

Try something like this

(?:\w+)(?<prsnl_last>)([\s]*(?<prsnl_credentials>[\w]*)|)[\s]*,[\s]*(?<prsnl_first>\w+)([\s]*(?<prsnl_middle>[\w]+.*?)|)

Here is an example using rex

| makeresults 
| eval name="Kirk Captn, James T"
| rex field=name "(?:\w+)(?<prsnl_last>)([\s]*(?<prsnl_credentials>[\w]*)|)[\s]*,[\s]*(?<prsnl_first>\w+)([\s]*(?<prsnl_middle>[\w]+.*?)|)"

[poojithavasanth]

Thaks for the inputs. 

I tried using the provided Regex; however it picks up space as the prsnl_last and then does not give any value in that column. Can we have a regex which picks up prsnl_last name only and then removes it while displaying them?

[ITWhisperer]

It sounds like you have two steps, one to extract the fields and another to display them. You can either extract the field with a value (as in my first suggestion), or without a value (as in my latest suggestion). When you come to display it in dashboard, you could change the value of the field before displaying it (eval) or remove the field from the field list (fields).