topic Separating the string in the field in Splunk Search

Separating the string in the field

mayank101 — Thu, 18 Jul 2019 20:05:44 GMT

I have various search string under the field name entity:

        Entity
 1   ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf
 2   FSD:BOOT2NDSUNMONTH_MAINT3_erewrewre
 3    AFE:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_sdfsdfdsf

and so on..
I want field such as BOOT2NDSUNQTR,BOOT2NDSUNMONTH_MAINT3 to be separated out and put it into a different field called jobname.Can you please help me in writing the regex for the same

Re: Separating the string in the field

Vijeta — Thu, 18 Jul 2019 20:32:09 GMT

@mayank101 See example below

| makeresults |eval Entity=" ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf"| rex field=Entity "(?<jobname>\S+_\S+)_"

Re: Separating the string in the field

vnravikumar — Thu, 18 Jul 2019 21:17:12 GMT

Try this

| makeresults 
| eval test="ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf,FSD:BOOT2NDSUNMONTH_MAINT3_erewrewre,AFE:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_sdfsdfdsf" 
| makemv test delim="," 
| mvexpand test 
| rex field=test "\:(?P<test>[\S]+)" 
| eval result=split(test,"_") 
| eval jobName =mvindex(result,0)."_".mvindex(result,1) 
| table jobName