topic Re: How to extract substring in a string for eval case? in Splunk Search

How to extract substring in a string for eval case?

Chandras11 — Fri, 13 Apr 2018 11:08:45 GMT

Hi All,

I have a field "CATEGORY3," with strings for example:-
Log 1.2 Bundle With 12 INC

Log 1.2 Bundle With 3 INC
Log 1.2 Bundle With 103 INC
Log 1.3 IP
Log 1.3 IP

I just need to extract the number of INCs if the CATEGORY3 contains Bundle Keyword. I tried something like substr(CATEGORY3,19,3), but it won't give a proper answer.
I was trying to look for regex as well, but I really do not know how to rex command inside eval case

index="index1" sourcetype="XXX" | eval NE_COUNT= case(match(CREATOR_SUBJECT,"Bundle"),  , match(CREATOR_SUBJECT,"IP"), 1 )

Thanks in advance

Re: How to extract substring in a string for eval case?

p_gurav — Fri, 13 Apr 2018 12:27:59 GMT

Hi,

Can you try below rex which only works on event which has Bundle keyword:

| rex field=_raw "Bundle With (?P<inc_count>\d+) INC"

Re: How to extract substring in a string for eval case?

elliotproebstel — Fri, 13 Apr 2018 12:56:57 GMT

Hey @p_gurav - I think your code is getting mangled because you forgot to use the 010101 code button. Maybe fix it so the user can test? I think your answer is probably correct!

Re: How to extract substring in a string for eval case?

adonio — Fri, 13 Apr 2018 13:53:17 GMT

hello there,
try this:
... your search ... | rex field=CATEGORY3 "Bundle With (?P<num_of_inc>\d+) INC"
hope it helps

Re: How to extract substring in a string for eval case?

Chandras11 — Fri, 13 Apr 2018 14:29:40 GMT

Thanks for the Answer. Its working and I learn a new point here. Just want to point that instead of checking in _raw , we can also use the field name CATEGORY3 for faster exeution.

Re: How to extract substring in a string for eval case?

rogerdpack — Fri, 22 Nov 2019 21:05:52 GMT

for followers, in general you extract using substr in an "eval" see https://answers.splunk.com/answers/210683/how-to-use-substr-to-extract-the-first-3-letters-o.html