topic Re: Field extraction based on position of character in Splunk Search

Field extraction based on position of character

mbasharat — Wed, 09 Oct 2019 14:52:00 GMT

Hi,

I have field that gives me NETBOS of a Host.

Sample Host Name: 123456W12345678

The 7th character makes the identification for whether it is server or not a server.

How to extract this 7th character into a new field "Classification"? Result using above example should be:
field name=Classification
field value=W

Thanks in advance!!!

mayurr98 — Wed, 09 Oct 2019 16:33:09 GMT

try this :

| makeresults | eval host="123456412345678" | rex field=host "(\d{6}|\w{6})?(?<Classification>\w{1})"

mbasharat — Fri, 11 Oct 2019 01:41:33 GMT

Worked. THANKS!!!