<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Regex: Help with breaking down a string in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/555191#M9165</link>
    <description>&lt;P&gt;In your first example your string was DOWN_X9 i.e. only one letter between the underscore _ and the number 9, so it matched your regex. In the second example, all your strings had more than one letter and indeed some were even lower case, which meant they didn't match the regex so no field was extracted.&lt;/P&gt;</description>
    <pubDate>Wed, 09 Jun 2021 22:17:58 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-06-09T22:17:58Z</dc:date>
    <item>
      <title>Regex: Help with breaking down a string</title>
      <link>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/554989#M9156</link>
      <description>&lt;P&gt;Hello everyone,&lt;BR /&gt;&lt;BR /&gt;Thank you for the help in advance.. I would like to break down a string of values into LETTERS and NUMBERS after the "_" character. For example if I the string NEXTTOWN_YU8392 I would want to get LETTERS= YU and NUMBERS equal to 8392 I have tried this code:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval string="DOWN_X9"
| rex field=string "_(?&amp;lt;letters&amp;gt;[A-Z])(?&amp;lt;numbers&amp;gt;\d+)"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;and it gives me:&lt;BR /&gt;letters=X&lt;BR /&gt;numbers=9&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;but when I try something like:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?&amp;lt;letters&amp;gt;[A-Z])(?&amp;lt;numbers&amp;gt;\d+)"&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;it returns nothing at all... I will be so thank you if you could help me out find my error please!&lt;BR /&gt;what I would like would be:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;TEST&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;letters&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;numbers&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;&lt;SPAN&gt;DOWN_XX9&lt;/SPAN&gt;&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;XX&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;9&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;UP_xxx90&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;XXX&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;90&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;LEFT_tUIJ89&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;tUIJ&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;89&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;thanks guys!&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 09 Jun 2021 01:15:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/554989#M9156</guid>
      <dc:creator>andres91302</dc:creator>
      <dc:date>2021-06-09T01:15:28Z</dc:date>
    </item>
    <item>
      <title>Re: Regex: Help with breaking down a string</title>
      <link>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/555035#M9159</link>
      <description>&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?&amp;lt;letters&amp;gt;[A-Za-z]+)(?&amp;lt;numbers&amp;gt;\d+)"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 09 Jun 2021 07:10:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/555035#M9159</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-06-09T07:10:14Z</dc:date>
    </item>
    <item>
      <title>Re: Regex: Help with breaking down a string</title>
      <link>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/555190#M9164</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;so the "plus" sign was the only thing missing? I'm so sorry sir I will very much appreciate if you could explain to me why it was working with the first example my code but it didn't work for my second one?&lt;/P&gt;</description>
      <pubDate>Wed, 09 Jun 2021 22:12:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/555190#M9164</guid>
      <dc:creator>andres91302</dc:creator>
      <dc:date>2021-06-09T22:12:09Z</dc:date>
    </item>
    <item>
      <title>Re: Regex: Help with breaking down a string</title>
      <link>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/555191#M9165</link>
      <description>&lt;P&gt;In your first example your string was DOWN_X9 i.e. only one letter between the underscore _ and the number 9, so it matched your regex. In the second example, all your strings had more than one letter and indeed some were even lower case, which meant they didn't match the regex so no field was extracted.&lt;/P&gt;</description>
      <pubDate>Wed, 09 Jun 2021 22:17:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Regex-Help-with-breaking-down-a-string/m-p/555191#M9165</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-06-09T22:17:58Z</dc:date>
    </item>
  </channel>
</rss>

