All Apps and Add-ons

how to use regression expression to extract a field

hqw
Path Finder

hi all,

i have one filed called value, it is a value like : 1006718, but it contains two information, 10067 is the real score, 18 is another filed called steps. May i know how can I separate this value into two fields, one is called real_value, another is called move_steps?

my search:
(label="Score*") value |stats count(_raw) by value |rename value AS Score

my result:
Score

1006718

0 Karma
1 Solution

echalex
Builder

Hi,

This regular expression is only valid if the value of steps always corresponds to the last two digits of value:

... |rex field=value "^(?<score>\d*)(?<steps>\d\d)$" 

If steps can consist of one digit or more than two digits, then you can only guess.

View solution in original post

0 Karma

echalex
Builder

Hi,

This regular expression is only valid if the value of steps always corresponds to the last two digits of value:

... |rex field=value "^(?<score>\d*)(?<steps>\d\d)$" 

If steps can consist of one digit or more than two digits, then you can only guess.

0 Karma

hqw
Path Finder

Hi echalex,

Thanks for your help, it really works.

Best Regards
hqw

0 Karma

vincenteous
Communicator

Does the value have fixed format (in your example it's 7 digits format)?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>