https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542970#M153810 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229747">@priyastalin</a>,</P><P>try this regex</P><LI-CODE lang="markup">"index=71412-cli sourcetype=show_interface | rex field=interface "^Port-channel(?&lt;port_id&gt;.*)" | table type interface port_id</LI-CODE><P>that you can test at&nbsp;<A href="https://regex101.com/r/XtkQiZ/1" target="_blank">https://regex101.com/r/XtkQiZ/1</A></P><P>Don't use "-" in the field name, but "_".</P><P>Ciao.</P><P>Giuseppe</P> Tue, 09 Mar 2021 08:19:56 GMT gcusello 2021-03-09T08:19:56Z https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542965#M153807 <P>Hi, <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/201110">@niketn</a>&nbsp;</P><P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/215385">@dmarling</a>&nbsp;</P><P>Could you Please help me with my doubt</P><P><STRONG>Query:</STRONG></P><P>"index=71412-cli sourcetype=show_interface | fields type interface operStatus |table type interface operStatus |search interface=port*"</P><P><EM>output of the query</EM></P><P><STRONG>type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; interface</STRONG><BR />Port-channel&nbsp;&nbsp;&nbsp;&nbsp; Port-channel1<BR />Port-channel&nbsp;&nbsp;&nbsp;&nbsp; Port-channel261<BR />Port-channel &nbsp; &nbsp; Port-channel100<BR />Port-channel &nbsp; &nbsp; Port-channel99.202<BR />Port-channel &nbsp; &nbsp; Port-channel99.200<BR />Port-channel &nbsp; &nbsp; Port-channel99.160<BR />Port-channel &nbsp; &nbsp; Port-channel99.159<BR />Port-channel &nbsp; &nbsp; Port-channel99.158<BR />Port-channel &nbsp;&nbsp; Port-channel99.157</P><P>I need to capture only the values after the <STRONG>Port-channel<EM>(99.157) </EM></STRONG>from the interface column and create separate column to print only the ids of port-channel</P><P><EM>Expected output</EM></P><P><STRONG>type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; interface&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; port-id</STRONG><BR />Port-channel&nbsp;&nbsp;&nbsp;&nbsp; Port-channel1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1<BR />Port-channel&nbsp;&nbsp;&nbsp;&nbsp; Port-channel261&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 261<BR />Port-channel &nbsp; &nbsp; Port-channel100&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 100<BR />Port-channel &nbsp; &nbsp; Port-channel99.202&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 99.202<BR />Port-channel &nbsp; &nbsp; Port-channel99.200&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 99.200<BR />Port-channel &nbsp; &nbsp; Port-channel99.160&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 99.160<BR />Port-channel &nbsp; &nbsp; Port-channel99.159&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 99.159<BR />Port-channel &nbsp; &nbsp; Port-channel99.158&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 99.158<BR />Port-channel &nbsp;&nbsp; Port-channel99.157&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 99.157</P><P>Please help me in solving this doubts</P><P>Thanks and regards,</P><P>Priya</P><P>&nbsp;</P> Tue, 09 Mar 2021 08:13:11 GMT https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542965#M153807 priyastalin 2021-03-09T08:13:11Z https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542970#M153810 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229747">@priyastalin</a>,</P><P>try this regex</P><LI-CODE lang="markup">"index=71412-cli sourcetype=show_interface | rex field=interface "^Port-channel(?&lt;port_id&gt;.*)" | table type interface port_id</LI-CODE><P>that you can test at&nbsp;<A href="https://regex101.com/r/XtkQiZ/1" target="_blank">https://regex101.com/r/XtkQiZ/1</A></P><P>Don't use "-" in the field name, but "_".</P><P>Ciao.</P><P>Giuseppe</P> Tue, 09 Mar 2021 08:19:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542970#M153810 gcusello 2021-03-09T08:19:56Z https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542975#M153811 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>,</P><P>Thank you so much for your input. Itworked fine</P> Tue, 09 Mar 2021 08:45:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542975#M153811 priyastalin 2021-03-09T08:45:07Z https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542977#M153812 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229747">@priyastalin</a>,</P><P>good for You!</P><P>Please, accept it for the other people of Community.</P><P>Ciao and Happy Splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 09 Mar 2021 08:47:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-fetch-the-filed-using-regex/m-p/542977#M153812 gcusello 2021-03-09T08:47:07Z