topic Re: How to extract 50A720 or 816851using | rex field=name mode=sed "s/816851/"? in Splunk Search

How to extract 50A720 or 816851using | rex field=name mode=sed "s/816851/"?

ashidhingra — Tue, 07 Jun 2022 17:40:21 GMT

The data i have is
816851-567-7554080981706881
50A720 -123-8150015922249983
816851-567-1135131573613120
816851-567-0065137870504409
50A720 -123-1135131573613120
816851-567-0065137870504409
50A720 -123-1135131573613120
50A720 -123-0065137870504409

I want to extract 50A720 or 816851using | rex field=name mode=sed "s/816851/"
getting error Error in 'rex' command: Failed to initialize sed. Failed to parse the replacement string.

Re: How to extract 50A720 or 816851using | rex field=name mode=sed "s/816851/"?

ITWhisperer — Tue, 07 Jun 2022 18:06:42 GMT

There seems to be some confusion with what you are trying to do. Are you trying to extract the first part of the field (before the first - sign) into another field, or are you trying to edit the field to remove the first part and do you want to do this only if it is specifically either 50A720 or 816851?

| rex field=name "^(?<firstpart>[^\-]+)\-" | rex field=name mode=sed "s/(50A720|816851)//g"

Re: How to extract 50A720 or 816851using | rex field=name mode=sed "s/816851/"?

ashidhingra — Tue, 07 Jun 2022 18:14:35 GMT

I only want to see 50A720 or 816851 in the ouput

Re: How to extract 50A720 or 816851using | rex field=name mode=sed "s/816851/"?

ITWhisperer — Tue, 07 Jun 2022 18:27:29 GMT

If you want to do it with rex (although there are probably easier ways to do it), you could try this

| rex field=name mode=sed "s/(50A720|816851)(.*)/\1/g"

Re: How to extract 50A720 or 816851using | rex field=name mode=sed "s/816851/"?

ashidhingra — Tue, 07 Jun 2022 18:30:55 GMT

Awesome. thanks.