topic Re: How to extract a field based on character count? in Splunk Search

How to extract a field based on character count?

eamuncal — Tue, 07 Jun 2011 07:52:47 GMT

I have a field name X with the following value: 0123456789.
I want to create another field that is based on the first 4 characters of the field name X.
Then call it Y.

Any idea on how to do this? If its in bash my way would be to use cut -c1-4

Trying the regex and rex to no avail.

Thanks in advance.

emn.

Re: How to extract a field based on character count?

Ayn — Tue, 07 Jun 2011 08:16:27 GMT

This should do it:

rex field=X "^(?<Y>\d{4})"

Re: How to extract a field based on character count?

eamuncal — Tue, 07 Jun 2011 08:19:56 GMT

This sure did it! Thanks Ayn