All Apps and Add-ons

Split servername and display in another column

priya0709
Path Finder

How to use Regex query to separate servername which has different names eg:- 

WSINI601XASI01

WRDNA502XUSA05

WGBR601XGBR11

from below subject lines:—

1.  INC000027679570 | WSINI601XASI01| scom exchange 2k16: Failed to connect to computer

2.  Wo# 1197736/ INC00027697776/ please perform hardware diagnostic on WRDNA502XUSA05

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

| rex max_match=0 "(?<servername>[A-Z]{5}\d{3}[A-Z]{4}\d\d)"

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

| rex "(?<computer>W[A-Z0-9\d]+)"

————————————
If this helps, give a like below.
0 Karma

to4kawa
Ultra Champion

| rex max_match=0 "(?<servername>[A-Z]{5}\d{3}[A-Z]{4}\d\d)"

0 Karma

priya0709
Path Finder

Thank you

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...