topic Field Parsing Address for Numbers in Getting Data In

Field Parsing Address for Numbers

phandnny — Sat, 15 Feb 2020 07:02:19 GMT

I'm fairly new to Splunk. I have a field (address). How can I parse just the all numbers from an address line to a new field (so I can list it later in a table) ?

i.e. 123 W Smith St #1

Would become:

1231

Re: Field Parsing Address for Numbers

richgalloway — Sat, 15 Feb 2020 13:24:22 GMT

This should do it.

... | eval numbers=address | rex field=numbers mode=sed "s/(\D)//g"

Re: Field Parsing Address for Numbers

martin_mueller — Sat, 15 Feb 2020 13:44:02 GMT

Yeah, many roads lead to this particular Rome. Another one:

... | eval numbers = replace(address, "\D+", "")

Re: Field Parsing Address for Numbers

vnravikumar — Sat, 15 Feb 2020 14:20:15 GMT

Try this also

| makeresults 
| eval address ="123 W Smith St #1" 
| rex field=address max_match=0 "(?P<result>[0-9]+)" 
| eval result= replace(tostring(result),"\s","") 
| table address result