Extract field that contains capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard

[archananaveen]

Hi There,
I need to extract Field3 which can contain capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard. Please could you suggest the splunk expression for doing this? And also, how to remove duplicates in the list?

/Filed1/Field2/Field-3/xxxx/xxxx/xxx

Below regular expression is getting me field 3.
(\/\w+){2}\/(.*?)\/

Regards,

[gcusello]

Hi
does the above regex extract the wanted field?
if yes you could use it in search

your_search
| rex field=source "(\/\w+){2}\/(?<Field3>[^\/]*)"
| dedup Field3
| sort Field3
| table Field3

Bye.
Giuseppe

[cpetterborg · Accepted solution]

If your regex works on your data as you say it does, then this should work:

<search-to-get-your-data> | rex "(/\w+){2}/(?P<field3>.*?)/" | table field3 | dedup field3 | sort field3

[archananaveen]

Thank you. Search is working but taking a long time, is there anyway I could store values for this to a particular field to be used by other lookup's or queries later on?

[cpetterborg]

You can use the outputlookup command:

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/SearchReference/Outputlookup

There are a multitude of ways that you could use this, so I'm not going to elaborate here on how to do it. If you have specific questions about how you want to use it to store your data, open a new question here in Answers. Go through the doc first so that you can see what you are up against.