topic how can i trim until a specific character? in Splunk Search

how can i trim until a specific character?

ygdrassil — Thu, 01 Mar 2018 07:59:50 GMT

Hello,

I got a field that has a format and a value like this "S01-3101" and sometimes a value like this "S01-301"
i just want to get the value of 01 near the letter S and i want to trim the S and "-3101" .

My idea is to trim the value after the "-" and itself, but i dont know if it is possible.

Thank you for your answers!!!!!

Re: how can i trim until a specific character?

493669 — Thu, 01 Mar 2018 12:44:11 GMT

try this regex:

   ... |rex field=<fieldname>"^.(?<test>\d+)"

Try this run anywhere search:

|makeresults|eval _raw="S01-3101"|rex field=_raw"^.(?<test>\d+)"

Re: how can i trim until a specific character?

ygdrassil — Mon, 05 Mar 2018 03:12:54 GMT

Thank you for the answers , i already answer this question by using substrt()

Re: how can i trim until a specific character?

niketn — Mon, 05 Mar 2018 07:30:27 GMT

@ygdrassil, please go ahead and mention your approach to fix the issue and Accept the same as answer.

In your question you have first mentioned that you are interested in digits after S and then also digits after dot (.)

<YourBaseSearch> yourFieldName=*
| rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)"

If the field value is present on the events you are interested in and you always need this extraction you should check out Field Extraction Knowledge Objects (this way the regular expression based field extraction will persist as Knowledge Object and can be easily maintained and reused.).

Following are some of Splunk Documentation reference for the same: http://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Extractfieldswithsearchcommands
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields
Following is a run anywhere search based on sample data provided:

| makeresults
| eval yourFieldName="S01-3101,S01-301"
| makemv yourFieldName delim="," 
| mvexpand yourFieldName
| rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)"