topic Re: Extract last 3 characters from field in Splunk Search

Extract last 3 characters from field

ahogbin — Thu, 07 Jul 2016 01:04:02 GMT

Hello,

I am trying to extract the last 3 characters from an extracted field. The field is in the format of 122RN00578COM or QN00001576VSD - numbers vary and length may vary over time) and the characters I am trying to extract are COM, VSD etc

I have tried using Substr and whilst this works in the short term any variation in length of field throws it off.
Is there a more robust method that will allow for changes in field length whilst maintaining the extraction of the last 3 characters (these are always letters)?

Thanks in advance for any help or suggestions.

Alastair

Re: Extract last 3 characters from field

sundareshr — Thu, 07 Jul 2016 01:12:25 GMT

This should give you last 3,

substr(x, len(x)-2, 3)

The other option would be to use rex

rex field=x "(?<y>\w{3})$"

Re: Extract last 3 characters from field

ahogbin — Thu, 07 Jul 2016 01:19:05 GMT

Superstar.. thank you so much

Re: Extract last 3 characters from field

JCISplunker — Tue, 23 Jul 2019 03:57:01 GMT

Why not the simpler with negative index:

substr(x,-3)