<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Field extraction - only 2 characters in Installation</title>
    <link>https://community.splunk.com/t5/Installation/Field-extraction-only-2-characters/m-p/539323#M7163</link>
    <description>&lt;P&gt;I need to extract two characters to a new field. The query I have written is able to remove the first 6 characters and it retrieves from 7th character till the end.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;Data:&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;{&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-3"&gt;&lt;SPAN class="key-name"&gt;type&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;Identifier&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-3"&gt;&lt;SPAN class="key-name"&gt;value&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;1234567890ABCDEF&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;}&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;{\"type\":\"Identifier\",\"value\":\"(?:.{6})(?&amp;lt;idCode&amp;gt;.*?)\"}&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;The query returns "&lt;SPAN&gt;&lt;SPAN class="key level-3"&gt;&lt;SPAN class="t string"&gt;7890ABCDEF&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;" whereas I need only "78". Could someone please help me to fix the issue?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Wed, 10 Feb 2021 16:54:06 GMT</pubDate>
    <dc:creator>rajkskumar</dc:creator>
    <dc:date>2021-02-10T16:54:06Z</dc:date>
    <item>
      <title>Field extraction - only 2 characters</title>
      <link>https://community.splunk.com/t5/Installation/Field-extraction-only-2-characters/m-p/539323#M7163</link>
      <description>&lt;P&gt;I need to extract two characters to a new field. The query I have written is able to remove the first 6 characters and it retrieves from 7th character till the end.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;Data:&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;{&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-3"&gt;&lt;SPAN class="key-name"&gt;type&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;Identifier&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;SPAN class="key level-3"&gt;&lt;SPAN class="key-name"&gt;value&lt;/SPAN&gt;:&amp;nbsp;&lt;SPAN class="t string"&gt;1234567890ABCDEF&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;}&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;{\"type\":\"Identifier\",\"value\":\"(?:.{6})(?&amp;lt;idCode&amp;gt;.*?)\"}&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;The query returns "&lt;SPAN&gt;&lt;SPAN class="key level-3"&gt;&lt;SPAN class="t string"&gt;7890ABCDEF&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/SPAN&gt;" whereas I need only "78". Could someone please help me to fix the issue?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 10 Feb 2021 16:54:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Installation/Field-extraction-only-2-characters/m-p/539323#M7163</guid>
      <dc:creator>rajkskumar</dc:creator>
      <dc:date>2021-02-10T16:54:06Z</dc:date>
    </item>
    <item>
      <title>Re: Field extraction - only 2 characters</title>
      <link>https://community.splunk.com/t5/Installation/Field-extraction-only-2-characters/m-p/539325#M7164</link>
      <description>&lt;P&gt;This may help..&lt;/P&gt;&lt;P&gt;"value:\s+.{6}(?&amp;lt;val&amp;gt;.{2})"&lt;/P&gt;</description>
      <pubDate>Wed, 10 Feb 2021 17:03:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Installation/Field-extraction-only-2-characters/m-p/539325#M7164</guid>
      <dc:creator>saravanan90</dc:creator>
      <dc:date>2021-02-10T17:03:25Z</dc:date>
    </item>
  </channel>
</rss>

