topic Re: I have field DivionsID with data of Exe.123, how to trim this to just 123 ? in Splunk Search

I have field DivionsID with data of Exe.123, how to trim this to just 123 ?

sumandevops — Thu, 15 Apr 2021 14:20:26 GMT

I have field DivionsID with data of Exe.123, how to trim this to just 123 ?

scelikok — Thu, 15 Apr 2021 15:18:53 GMT

You can use rex command, below will output a new field div_no.

| rex field=DivionsID "(?<div_no>\d+)"

sumandevops — Thu, 15 Apr 2021 15:59:53 GMT

why create a new field div_no?

| rex filed = DivisionId " (?<DivisionId>\d+)" wouldn’t work?

sumandevops — Thu, 15 Apr 2021 16:09:38 GMT

this is not working mate

venky1544 — Thu, 15 Apr 2021 16:16:25 GMT

ideally regex should work if not you could try the replace command something like below

|makeresults |eval data="Exe.123" |replace "Exe.123" with "123" |table data

sumandevops — Thu, 15 Apr 2021 16:35:44 GMT

I didn't get you, please elaborate

scelikok — Thu, 15 Apr 2021 17:28:09 GMT

If you want to overwrite the field it should work;

| rex field = DivisionId "(?<DivisionId>\d+)"

venky1544 — Thu, 15 Apr 2021 17:42:12 GMT

HI Suman

you wanted to trim the data Exe.123 to 123 right so you can either use regex like others or specifying or use the replace command

it would be great if could share the more about the data and what command are you executing with regex

its not helping when you say its not working or please elaborate