topic Re: Extract substring from field in Splunk Search

Extract substring from field

alesSantiago — Fri, 08 Nov 2013 16:51:21 GMT

Hi,

I'm facing a problem with string extraction . The scenario is as follows: I'm passing an ID from one chart to another form through URL and, before populating it to the new charts, I need to "remove" some additional data from that string.

Let's say that I receive this kind of string ID: "idfromchart(reverse)" through the URL and I need just the "idfromchart" without the "(reverse)" part. First I need to format the id to the correct value, then I'll try to populate it actually...one step at a time 😉

Any help provided it would be really appreciated.
Thanks!

Re: Extract substring from field

somesoni2 — Fri, 08 Nov 2013 17:08:35 GMT

For your step1. Formatting of id (assuming the format of the URL parameter is same as your example, means it contains "(" symbol.

* |head 1| eval body="somestring(reverse)" | table body | eval body1=mvindex(split(body,"("),0) |rex field=body "(?<body2>[^(]+)"

you can use any one of body1 or body2 for your formatting.

Re: Extract substring from field

jtrucks — Sat, 09 Nov 2013 00:42:10 GMT

Try replace. Maybe something like:

… | replace idfromchart* with idfromchart in yourfieldname

Or…

… | replace "*(reverse)" with "*" in yourfieldname

I'd go with the latter option first, actually.

Re: Extract substring from field

alesSantiago — Mon, 11 Nov 2013 12:24:02 GMT

The second option happened to format the ID to what I wanted. Thanks.
Out of this question, would you be able to tell me if the tag supports queries? I'm thinking about how to populate the formatted id and populate it to the rest of the charts through a dropdown.
thanks again!

Re: Extract substring from field

alesSantiago — Mon, 11 Nov 2013 12:29:11 GMT

Thanks for your answer.
I did try this solution, but I wasn't able to make it work the way I wanted.
So the reason why I didn't mark it as a valid answer was not about that it might be or not correct (sure it is), it is about my lack of knowledge in regex. It might be useful for somebody else.
thanks 🙂