topic Re: How do you take a value out of a field and make a new field with it? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410296#M167235 <P>Thank you very much!</P> Fri, 05 Oct 2018 21:07:51 GMT aatha89 2018-10-05T21:07:51Z How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410288#M167227 <P>How do i take out the port number (portnr) from the args field and make it to a field called "port" by a search? Can the answer here be to use <CODE>eval</CODE> and <CODE>rex</CODE> ?</P> Fri, 05 Oct 2018 20:37:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410288#M167227 aatha89 2018-10-05T20:37:32Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410289#M167228 <P>try<BR /> <CODE>YOUR_SEARCH | rename portnr as port</CODE></P> Fri, 05 Oct 2018 20:40:21 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410289#M167228 kamlesh_vaghela 2018-10-05T20:40:21Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410290#M167229 <P>My logline her is:<BR /> _time command Args<BR /> 24.05.1998 17:54 splunkA A_4040_restart</P> <P>4040 is the portnr. I just want to take out portnr and put it a new field called port</P> Tue, 29 Sep 2020 21:30:49 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410290#M167229 aatha89 2020-09-29T21:30:49Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410291#M167230 <P>Yes , you can use this rex command to get port- <CODE>rex field=Args "_(?&lt;port&gt;\d{4})_"</CODE></P> Fri, 05 Oct 2018 20:42:13 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410291#M167230 Vijeta 2018-10-05T20:42:13Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410292#M167231 <P>Thanks for your reply! But my full question was:</P> <P>My logline her is:<BR /> _time command Args // fields<BR /> 24.05.1998 17:54 splunkA A_4040_restart //Values</P> <P>4040 is the portnr. I just want to take out portnr and put it a new field called port</P> Tue, 29 Sep 2020 21:30:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410292#M167231 aatha89 2020-09-29T21:30:52Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410293#M167232 <P>Thanks :). Do you think i will need to use eval here? or will it just be fine to use rex ?</P> Fri, 05 Oct 2018 20:45:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410293#M167232 aatha89 2018-10-05T20:45:52Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410294#M167233 <P>rex will be fine, no need for eval if you just want to get port number in port field.</P> Fri, 05 Oct 2018 20:48:08 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410294#M167233 Vijeta 2018-10-05T20:48:08Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410295#M167234 <P>try this</P> <PRE><CODE>YOUR_SEARCH | rex field=args "_(?&lt;port&gt;.*)_" </CODE></PRE> <P>Sample:</P> <PRE><CODE>| makeresults | eval args="A_4040_restart" | rex field=args "_(?&lt;port&gt;.*)_" </CODE></PRE> Fri, 05 Oct 2018 20:49:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410295#M167234 kamlesh_vaghela 2018-10-05T20:49:46Z Re: How do you take a value out of a field and make a new field with it? https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410296#M167235 <P>Thank you very much!</P> Fri, 05 Oct 2018 21:07:51 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-take-a-value-out-of-a-field-and-make-a-new-field-with/m-p/410296#M167235 aatha89 2018-10-05T21:07:51Z