topic Re: How do I extract last numbers in field in Splunk Search

How do I extract last numbers in field

dfigurello — Tue, 25 Feb 2014 17:33:38 GMT

Hello Splunkers,

I Would like to create a new field with the last numbers in another field called logid

For example:

logid = 0101232010

logid = 0101242010
logid = 0101240210

I want create a new field with last 5 numbers, like as:

id= 32010
id= 42010
id= 40210

Could I create a regex for that?

Tks.

reed_kelly — Tue, 25 Feb 2014 17:46:02 GMT

If I understand correctly, you just want to extract the last 5 characters of a field. Here is an example using the rex command:

|gentimes start=-1 |eval foo="1232134324" |rex field=foo "(?<id>\d{5})$" |table foo,id

returns: foo=1232134324 id=34324

dfigurello — Mon, 28 Sep 2020 15:58:24 GMT

hi reed.kelly,

I don't get it. I am trying it into my search. Look at my seach:

sourcetype=fortigate subtype=admin pri=warning | stats count by log_id | rex field=log_id "(?d{5})$" | table log_id

Any idea ?

reed_kelly — Tue, 25 Feb 2014 18:51:02 GMT

The backslash before the "d{5}" didn't get rendered. I have edited my answer to fix that. It should be "\d{5}"

MuS — Tue, 25 Feb 2014 19:28:59 GMT

For a start keep it simple and just try to get the field=value pair like this:

sourcetype=fortigate subtype=admin pri=warning | rex "(?<log_id>\d{5})$" | table log_id

somesoni2 — Tue, 25 Feb 2014 20:03:27 GMT

Another options could be using substring.

sourcetype=fortigate subtype=admin pri=warning | stats count by log_id | eval newfield=substr(log_id,len(log_id)-4) | table log_id, newfield

somesoni2 — Mon, 28 Sep 2020 15:58:29 GMT

Also, you've kept the name of new field same as old field, use following
...| rex field=log_id "(?\d{5})$" | table log_id,id

dfigurello — Wed, 26 Feb 2014 14:12:10 GMT

Thank you Splunkers!

🙂