Dashboards & Visualizations

how will i filter rows with specific column specification

kavyatim
Path Finder

Hi ,

I have a table called "Database" with column like this :
COD_SC_CSO
51681
11680
11680
11268
11251
I would like to filter rows only where COD_SC_CSO 2 and 3 position is 68. .
For example if COD_SC_CSO =51681(2 and 3 position is 68), i want to filter entire row of COD_SC_CSO =51681

Can any one help me out to do this.

Thanking

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Well, you almost got the answer yourself, you just need to reorder your search a bit.

source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | search str=68 | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You are not entirely clear by "filter" if you mean to "keep" or to "throw away" the items with the substring of '68'.

Don't forget, the where command can do almost anything eval can do, but can do comparisons as well. So this should work as well:

source="base_bds_adsl.csv" | where  (substr(COD_SC_CSO,3,2)=68)  

Ayn
Legend

Well, you almost got the answer yourself, you just need to reorder your search a bit.

source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | search str=68 | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

cmeinco
Path Finder

I'm not sure which is more efficient, but since my brain works in regex, this would also work:

source="base_bds_adsl.csv" | regex COD_SC_CSO="^\d{2}68\d$" | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

0 Karma

kavyatim
Path Finder

Its a splunk search question:

For time being my query is as follows:
source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | table str,N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla| where str="68

but i dont want to display str in my table

0 Karma

cmeinco
Path Finder

Is this a splunk search question? Or are you asking how to only index the filtered data ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...