topic Re: Rex to select number from string in Splunk Search

Rex to select number from string

abbam — Wed, 07 Mar 2018 12:58:15 GMT

Hi All,

I am trying to select numbers from a field using Rex, but I cannot seem to figure it out.

Basically the values that i have in the field are:

XX (432)
FH02 (2356)
YR01 (855553)

I want to be able to select the number in the () - this number can be of any length.

How can I do this?

Thanks!

493669 — Wed, 07 Mar 2018 13:04:05 GMT

Hi @abbam,
try this:

|rex field=<fieldname> "\((?<number>\d+)"

try this run anywhere search:

|makeresults|eval sample="XX (432)"|rex field=sample "\((?<number>\d+)"

mayurr98 — Wed, 07 Mar 2018 13:25:50 GMT

You can try something like this

<your base search> | rex field=<fieldname> "\s\((?<number>[^\)]+)"

let me know if this helps!

abbam — Wed, 07 Mar 2018 13:31:55 GMT

Thank you!

How would you do it if the field was multivalue?

mayurr98 — Wed, 07 Mar 2018 13:37:43 GMT

try this if the field is multivalue

| rex field=<fieldname> max_match=0 "\s\((?<number>[^\)]+)"

abbam — Wed, 07 Mar 2018 13:45:52 GMT

thank you! worked perfectly!