topic Re: Fetching alphanumeric value and numeric values in aline in Splunk Search

Fetching alphanumeric value and numeric values in aline

Arani_Hari — Mon, 12 Feb 2024 17:04:15 GMT

How to extract alphanumeric and numeric values from aline, both are dynamic values

<Alphanumeric>_ETC_RFG: play this message: announcement/<numeric>

Re: Fetching alphanumeric value and numeric values in aline

ITWhisperer — Mon, 12 Feb 2024 17:13:29 GMT

regex101.com is a good site for testing regex

Re: Fetching alphanumeric value and numeric values in aline

Arani_Hari — Mon, 12 Feb 2024 18:31:39 GMT

I tried below syntax but it's matching entire line but I want only "ID" value /(?<ID>\w+)_ETC_RFG

Re: Fetching alphanumeric value and numeric values in aline

bowesmana — Mon, 12 Feb 2024 21:38:34 GMT

Can you share your SPL and data. This example works

| makeresults | eval line="SOMEALPHA9876NUMERIC_ETC_RFG: play this message: announcement/12345678" | rex field=line "(?<ID>\w+)_ETC_RFG:.*/(?<NUM>\d+)"

Re: Fetching alphanumeric value and numeric values in aline

Arani_Hari — Tue, 13 Feb 2024 01:40:31 GMT

log line will be

05:02:05.213 Txt 46000 008a456b37de5982_ETC_RFG: (Q056) play this message id:announcement/4637825, duration:58

expecting Table like

008a456b37de5982 ETC RFG 4637825

Re: Fetching alphanumeric value and numeric values in aline

ITWhisperer — Tue, 13 Feb 2024 09:24:17 GMT

You are not really giving us sufficient information. The rex command that @bowesmana provided extracts the alphanumeric and numeric as you asked. Your "table" doesn't identify what the columns are called. Are ETC and RFG fixed non-varying constant strings? Do these need to be in separate fields in the table? Please clarify your requirement, although, tbh, you already appear to have been given a workable solution.

Re: Fetching alphanumeric value and numeric values in aline

Arani_Hari — Tue, 13 Feb 2024 17:12:07 GMT

sorry, if i confused. Yes, ETC and RFG are fixed and need to add in table

Log Line:

05:02:05.213 Txt 46000 008a456b37de5982_ETC_RFG: (Q056) play this message id:announcement/4637825, duration:58

i tired to get result with below query, but not working properly

Re: Fetching alphanumeric value and numeric values in aline

ITWhisperer — Tue, 13 Feb 2024 16:35:27 GMT

| rex field=line "(?<ID>\w+)_ETC_RFG:.*/(?<NUM>\d+)" | eval ETC="ETC", RFG="RFG"