Splunk Search

Extract only few characters from string

kavyatim
Path Finder

hi i want to extract only 2,3,4,6 position characters from the below set 1DA222
1DA222
1DA222
1DA121
1DA122
1DA222
1DA222
1DA222
Expected output will be DA22,DA11 so on. .

Can any one help me out in writing regex for this.

Thanking you in advance.

Tags (1)

thesteve
Path Finder

Not sure where you are using this, but in general:

^.(.{3}).(.)

The ^ character matches the start of a string.

. will match any character, we don't care about the first character, so we're leaving that out of the grouping.

(.{3}) will match any character 3 times. Surrounding it by parenthesis makes it a grouped match.

. will match any character again, this time we're matching the fifth character and leaving it out of the grouping

(.) the last part of the regex grabs the next character, which is the 6th position and adds it to a grouping.

At this point you have a regex that will pull characters at positions 2,3,4, and 6. Those characters are in 2 match groupings. The first grouping contains characters 2,3, and 4. The second grouping contains character 6.

Unfortunately I don't know of a way to phrase a single regex expression that will strip a character from the middle of a string.

Alternatively, you could replace the '.' characters with '\S' to match non-whitespace.

Also generally, a regex substitution can be used, such as

s/^.(.{3}).(.)/\1\2/

s/match/replace/ The match hasn't changed from above, but the \1\2 in the replace part means take any matched text and replace it with Group1Group2, where Group1 is characters at position 2,3,4 and Group2 is the character at position 6. Depending on where you want to use the regular expression, substitution might or might not be possible.

Note: I haven't tested the above regular expressions, so my syntax might be a little off.

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

Please try the following:

rex field=yourfield mode=sed "s/\w(\w{3})\w(\w)/\1\2/g"

thesteve
Path Finder

That's right. I was thinking of \b. Sorry, regular expressions strain my brain sometimes.

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

\w is "A single word character - alphanumeric and underscore."

thesteve
Path Finder

Isn't "\w" a word boundary? I thought maybe you meant "\S" for non-whitespace.

0 Karma

kavyatim
Path Finder

Thank you very much for regex . .it worked

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...