All Apps and Add-ons

I have a task name = xyz. I want to edit its name and use it in my query as xy . Is that possible?

shrey12
Explorer
 
0 Karma

stephanefotso
Motivator

Yes! you can extract xy in the name field and use it as you want. Something like this

...|rex field=name "(?<mynewfield>your regex)"|table mynewfield

Now you have a new field called mynewfield with the value of what you have extracted in name field. Let say xy, and you can use it after the extraction .
Thanks

SGF
0 Karma

chimell
Motivator

Hi shrey12
Do you want to extract xy in "name = xyz" string ?
Please let me know

0 Karma

shrey12
Explorer

yes do you know how to do that ?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...