topic Re: regex substr help in Splunk Search

regex substr help

mcaulsc — Fri, 17 Sep 2021 13:35:31 GMT

Hi,

in anything else this would seem very simple but I seem to be flummoxed trying to do this in splunk. Probably not helped by having zero regex knowledge.

I have a field that has values in the format: AAAABBCC

I want to return all values that have BB in position 5, if anyone could be so kind as to provide a sample I can then pull it apart and try and work out how it does it.

Thanks.

Re: regex substr help

gcusello — Fri, 17 Sep 2021 13:43:52 GMT

Hi @mcaulsc,

Please try something like this:

index=your_index | eval BB=substr(your_field,5,2) | table _time BB

or using a regex:

index=your_index | rex field=your_field "\w{4}(?<BB>\w{2})\w{2"} | table _time BB

Ciao.

Giuseppe

Re: regex substr help

solarboyz1 — Fri, 17 Sep 2021 13:45:03 GMT

Assuming characters 1-4=A 5-6=B and 7-8=C, the following should work:

| rex field=YourField "(?<A_values>....)(?<B_values>..)(?<C_values>..)

You should now have three fields A_values, B_values, and C_values.

Re: regex substr help

mcaulsc — Fri, 17 Sep 2021 13:50:28 GMT

thanks, that gets me a list of all the possible values in pos 5 for 2. What I want is the whole value if I have a match.

so if I have AAAABBCC I have a match on BB in pos5,2 so return AAAABBCC

Re: regex substr help

gcusello — Fri, 17 Sep 2021 13:53:52 GMT

Hi @mcaulsc,

ok, if you want to search the values "xx" in the fifth and sixth posizion, try something like this:

index=your_index | eval BB=substr(your_field,5,2) | search BB="xx" | table _time your_field BB

Ciao.

Giuseppe

Re: regex substr help

mcaulsc — Fri, 17 Sep 2021 13:57:23 GMT

That's the one, been tying myself in knots with this for far longer than I should and ended up down regex rabbit holes that I didn't need to be down.
Many thanks for the help.

Re: regex substr help

gcusello — Fri, 17 Sep 2021 13:57:24 GMT

Hi @mcaulsc,

good for you, see nect time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉