topic Re: How to extract certain words and exclude words from string? in Splunk Search

How to extract certain words and exclude words from string?

marinella26 — Mon, 10 Jul 2023 06:05:38 GMT

Hello,

I want to extract certain words only and exclude that comes after numbers.

ex.
Apple12ed
Apple456ppp
Orange234iw
Banana7ye

expected result:
Apple
Orange
Banana

I have tried below, but the each string has different numbers and words, so the result is not correct.

| eval Fruits = substr(Fruits, 1, len(Fruits)-4)

incorrect Result:
Apple
Apple45
Orange2
Banan

Thanks in advance.

Re: How to extract certain words and exclude words from string?

marinella26 — Mon, 10 Jul 2023 06:10:33 GMT

There are more than 100 strings, so it is not ideal to use <eval> to create each strings.

Re: How to extract certain words and exclude words from string?

gcusello — Mon, 10 Jul 2023 06:23:05 GMT

Hi @marinella26 ,

I suppose that the words to extract are in a field, so you can use the rex command to extract the word in each field, something like this:

<your_Search> | rex field=your_field "^(?<word>[A-Za-z]*)" | table word

Ciao.

Giuseppe

Re: How to extract certain words and exclude words from string?

marinella26 — Tue, 11 Jul 2023 06:38:39 GMT

@gcusello It worked!! Thank you so much.

Re: How to extract certain words and exclude words from string?

duesser — Tue, 11 Jul 2023 06:52:56 GMT

Maybe using

^(?P<word>[a-zA-Z]+)(?=\d)

would be more exact, as it does not return an empty match on strings that do not start with a letter such as "_Apple". Furthermore, it makes sure the word is followed by a digit and does not match "Apple_" for example.