All Apps and Add-ons

I have a task name = xyz. I want to edit its name and use it in my query as xy . Is that possible?

shrey12
Explorer
 
0 Karma

stephanefotso
Motivator

Yes! you can extract xy in the name field and use it as you want. Something like this

...|rex field=name "(?<mynewfield>your regex)"|table mynewfield

Now you have a new field called mynewfield with the value of what you have extracted in name field. Let say xy, and you can use it after the extraction .
Thanks

SGF
0 Karma

chimell
Motivator

Hi shrey12
Do you want to extract xy in "name = xyz" string ?
Please let me know

0 Karma

shrey12
Explorer

yes do you know how to do that ?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...