How to extract a substring based on its position within a field?

mcgi906 — Mon, 11 Jul 2016 21:00:03 GMT

I have a field that is of the form /Code153:4:Item1,Item2,Item3,Item4/Code211:2:Item5,Item6 where I need to extract a substring in the form of Code###:#:Item,Item,Item.... based upon the location of a search. For example, if it was Item 2 I was searching for then the string Code 153:4:Item1,Item2:Item3:Item4 would be returned.

I am stumped on how to accomplish this.

Re: How to extract a substring based on its position within a field?

somesoni2 — Mon, 11 Jul 2016 21:25:20 GMT

Try like this

your current search | eval yourfield=split(yourfield,"/") | eval filteredVal=mvfilter(match(yourfield,"Item2"))

topic How to extract a substring based on its position within a field? in Splunk Search

How to extract a substring based on its position within a field?

Re: How to extract a substring based on its position within a field?