Dashboards & Visualizations
Highlighted

Extract field that contains capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard

Explorer

Hi There,
I need to extract Field3 which can contain capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard. Please could you suggest the splunk expression for doing this? And also, how to remove duplicates in the list?

/Filed1/Field2/Field-3/xxxx/xxxx/xxx

Below regular expression is getting me field 3.
(\/\w+){2}\/(.*?)\/

Regards,

0 Karma
Highlighted

Re: Extract field that contains capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard

SplunkTrust
SplunkTrust

If your regex works on your data as you say it does, then this should work:

<search-to-get-your-data> | rex "(/\w+){2}/(?P<field3>.*?)/" | table field3 | dedup field3 | sort field3

View solution in original post

0 Karma
Highlighted

Re: Extract field that contains capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard

Explorer

Thank you. Search is working but taking a long time, is there anyway I could store values for this to a particular field to be used by other lookup's or queries later on?

0 Karma
Highlighted

Re: Extract field that contains capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard

SplunkTrust
SplunkTrust

You can use the outputlookup command:

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/SearchReference/Outputlookup

There are a multitude of ways that you could use this, so I'm not going to elaborate here on how to do it. If you have specific questions about how you want to use it to store your data, open a new question here in Answers. Go through the doc first so that you can see what you are up against.

0 Karma
Highlighted

Re: Extract field that contains capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard

Legend

Hi
does the above regex extract the wanted field?
if yes you could use it in search

your_search
| rex field=source "(\/\w+){2}\/(?<Field3>[^\/]*)"
| dedup Field3
| sort Field3
| table Field3

Bye.
Giuseppe