All Apps and Add-ons

how to use regression expression to extract a field

hqw
Path Finder

hi all,

i have one filed called value, it is a value like : 1006718, but it contains two information, 10067 is the real score, 18 is another filed called steps. May i know how can I separate this value into two fields, one is called real_value, another is called move_steps?

my search:
(label="Score*") value |stats count(_raw) by value |rename value AS Score

my result:
Score

1006718

0 Karma
1 Solution

echalex
Builder

Hi,

This regular expression is only valid if the value of steps always corresponds to the last two digits of value:

... |rex field=value "^(?<score>\d*)(?<steps>\d\d)$" 

If steps can consist of one digit or more than two digits, then you can only guess.

View solution in original post

0 Karma

echalex
Builder

Hi,

This regular expression is only valid if the value of steps always corresponds to the last two digits of value:

... |rex field=value "^(?<score>\d*)(?<steps>\d\d)$" 

If steps can consist of one digit or more than two digits, then you can only guess.

0 Karma

hqw
Path Finder

Hi echalex,

Thanks for your help, it really works.

Best Regards
hqw

0 Karma

vincenteous
Communicator

Does the value have fixed format (in your example it's 7 digits format)?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...