topic Re: How to make substring using rex in Splunk Search

How to make substring using rex

splunkkid — Mon, 14 Sep 2020 08:17:55 GMT

Hello,

I am currently confront some problem here.

I want to substring data in specific column using rex.

The column's data looks like below(All same or similar style).

"****-****-**POD4-***"

In above case, all I need is the number after the word POD. ( * means some alphabets)

Any ideas?

Thank you.

Re: How to make substring using rex

ITWhisperer — Mon, 14 Sep 2020 08:32:05 GMT

| rex field=column "POD(?<number>\d+)\-"

where column is the field name your data is in.

Is it always POD? If not, is it always ****-****-**POD4-*** 4 letters "-" 4 letters "-" 2 letters 3 characters number (at least 1 digit) "-" 3 letters?

Re: How to make substring using rex

thambisetty — Mon, 14 Sep 2020 08:33:29 GMT

replace <choosefield> with field name from which you want to extract number after word POD. number will be extracted to new field called "podnumber"

| rex field=<choosefield> "POD(?<podnumber>\d+)"

Re: How to make substring using rex

splunkkid — Mon, 14 Sep 2020 08:47:57 GMT

@ITWhisperer

First, Thanks for your answer.

And I tried like below

MYSEARCH | rex field=pod "pod(?<number>\d+)" | sort podnumber | table pod podnumber

Erased the part "\-" because that makes no results, although i don't know why.

And * part could be different by row, so it doesn't really helpful I guess.

Re: How to make substring using rex

splunkkid — Mon, 14 Sep 2020 08:48:42 GMT

@thambisetty

Thanks! This worked exactly how I want.