All Apps and Add-ons

I have a task name = xyz. I want to edit its name and use it in my query as xy . Is that possible?

shrey12
Explorer
 
0 Karma

stephanefotso
Motivator

Yes! you can extract xy in the name field and use it as you want. Something like this

...|rex field=name "(?<mynewfield>your regex)"|table mynewfield

Now you have a new field called mynewfield with the value of what you have extracted in name field. Let say xy, and you can use it after the extraction .
Thanks

SGF
0 Karma

chimell
Motivator

Hi shrey12
Do you want to extract xy in "name = xyz" string ?
Please let me know

0 Karma

shrey12
Explorer

yes do you know how to do that ?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...