topic Re: How to match and filter by substr? in Splunk Search

How to match and filter by substr?

jaj — Tue, 18 Feb 2014 23:29:20 GMT

I have a log where

labelData=123-345

lableData=123

How I want to ignore the -345 and just keep the first 3 characters and report on the occurances. The above would count for two occurrences for labelData=123.

I can't seem to figure this out using:

source=*//logs/stdout.log class=myClass | fields labelData | eval newStuff=substr(labelData, 1, 43 | stats count by newStuff |  sort count | reverse

Input Note: labelData could also be 456-789. Basically, i just want to match/substr the first 3 characters.

Re: How to match and filter by substr?

lukejadamec — Tue, 18 Feb 2014 23:57:29 GMT

You can try

This will give you the full string in the results, but the results will only include values with the substring.

If you want to create a new field, then use rex.

Re: How to match and filter by substr?

jaj — Wed, 19 Feb 2014 16:32:39 GMT

thanks again!

Re: How to match and filter by substr?

lukejadamec — Wed, 19 Feb 2014 16:34:37 GMT

If you have multiple substrings to capture, then you can do that also.

Re: How to match and filter by substr?

jaj — Wed, 19 Feb 2014 16:56:23 GMT

QQ: what if the input was 456-789 or 789-012? how could I use a regex to extract the first three characters only?

Re: How to match and filter by substr?

lukejadamec — Wed, 19 Feb 2014 17:12:07 GMT

For multiple possibilities you would use the OR command for regex, which is the pipe |. For the first three characters only, use the "starts with" symbol, otherwise known as the carrot ^. I'm assuming you mean exactly 456 or 789.

|regex lableData="^456|^789"

To grab just the one that starts with 789, remove the OR.

|regex lableData="^789"

Re: How to match and filter by substr?

aishelm — Thu, 16 Oct 2014 13:52:27 GMT

This is a different answer inspired by above question and responses.

index="indexname" Type="Error"| eval messageInit=substr(Message, 1, 25)| top limit=20 messageInit