https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499423#M139095 <P>So basically, I am looking for help in filling in something like:<BR /> | rex field=FunctionArn .......................................</P> Fri, 31 Jan 2020 01:12:26 GMT petersonjared 2020-01-31T01:12:26Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499422#M139094 <P>Can someone please help me parse the field of FunctionArn for the account id value ( "65123456723" in the example) from the within a search that I can use to pass to a lookup to get the "friendly" account name of that account id?</P> <P>....<BR /> FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today<BR /> ....</P> <P>thank you!</P> Fri, 31 Jan 2020 01:10:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499422#M139094 petersonjared 2020-01-31T01:10:14Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499423#M139095 <P>So basically, I am looking for help in filling in something like:<BR /> | rex field=FunctionArn .......................................</P> Fri, 31 Jan 2020 01:12:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499423#M139095 petersonjared 2020-01-31T01:12:26Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499424#M139096 <P>Hi</P> <P>Check this</P> <PRE><CODE>| makeresults | eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" | eval temp=split(test,":") | eval accountid = mvindex(temp,5) | table accountid </CODE></PRE> <P>or</P> <PRE><CODE>| makeresults | eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" | rex field=test "FunctionArn:\s+\S+\:(?P&lt;accountid&gt;[[:digit:]]+)\:" </CODE></PRE> Fri, 31 Jan 2020 03:23:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499424#M139096 vnravikumar 2020-01-31T03:23:06Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499425#M139097 <P><CODE>[[:digit:]]</CODE>, cool.</P> Fri, 31 Jan 2020 09:07:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499425#M139097 to4kawa 2020-01-31T09:07:48Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499426#M139098 <P>This is fanastic, thank you! I am glad to learn about makeresults.</P> <P>Is there a way to have makeresult, or a different means, to have the "test" value able to run through the Splunk regex generation tool within extracting fields?</P> Fri, 31 Jan 2020 16:08:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499426#M139098 petersonjared 2020-01-31T16:08:13Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499427#M139099 <P>Equivalent to <CODE>\d</CODE> or <CODE>[0-9]</CODE></P> Fri, 31 Jan 2020 18:44:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499427#M139099 DalJeanis 2020-01-31T18:44:44Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499428#M139100 <PRE><CODE>| makeresults | eval _raw="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" | rex "FunctionArn:\s+\S+\:(?P&lt;accountid&gt;\d+)\:" | appendpipe [ eval accountid1=mvindex(split(_raw,":"),5) | appendpipe [ eval accountid2=replace(_raw,"^.*(\d{11}).*$","\1") | appendpipe [ rex "(?&lt;accountid3&gt;\d{11})"]]] </CODE></PRE> <P>like that?</P> Fri, 31 Jan 2020 22:40:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-field-to-use-later-in-a-table/m-p/499428#M139100 to4kawa 2020-01-31T22:40:51Z