topic Re: How to fetch values from a string using rex command in Splunk Search

How to fetch values from a string using rex command

Puvi — Thu, 07 Nov 2019 07:43:08 GMT

Hi,

i have a field with values like AB101, I want to extract 101 separately into a new field

renjith_nair — Thu, 07 Nov 2019 13:01:56 GMT

@Puvi,

Try

|rex field=field_name "(?<digits>\d+)"

where field_name is your field and digits is the new field

kartm2020 — Thu, 07 Nov 2019 13:42:27 GMT

Try this.
It will fetch the number followed by digits.
| rex field=field_name "A-Z"

If you have non-capital words. try the below

| rex field=field_name "[A-Z]a-z"

vnravikumar — Fri, 08 Nov 2019 05:40:43 GMT

Try this

| makeresults 
| eval temp="AB101" 
| rex field=temp "(?P<result>[\d]+)"

renjith_nair — Sun, 10 Nov 2019 12:30:44 GMT

@Puvi , please accept one of the answers which helped you or let's know if you need further help