Dashboards & Visualizations

New column using regex

yifatcy
Path Finder

Hi,

I have the field Queue in my dataset with pattern as follows:

adcams01

adcams02

adcems05

I would like to create a new column in my table which contains 3 letters after adc. For example:

Queue:Site
adcams01ams
adcams02ams
adcems05ems

Is it possible using regex? I know it should include eval but it didn't work for me.

Thank you

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yifatcy 

Try

YOUR_SEARCH
 | rex field=Queue "adc(?<Site>.{3})"

 

Sample Search:

| makeresults | eval _raw="Queue
adcams01
adcams02
adcems05" | multikv forceheader=1 | table Queue | rex field=Queue "adc(?<Site>.{3})"

 

Thanks
Kamlesh Vaghela 

If this reply helps you, an upvote would be appreciated.

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Queue "adc(?<Site>[^\d]+)"

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yifatcy 

Try

YOUR_SEARCH
 | rex field=Queue "adc(?<Site>.{3})"

 

Sample Search:

| makeresults | eval _raw="Queue
adcams01
adcams02
adcems05" | multikv forceheader=1 | table Queue | rex field=Queue "adc(?<Site>.{3})"

 

Thanks
Kamlesh Vaghela 

If this reply helps you, an upvote would be appreciated.

 

yifatcy
Path Finder

Works! thanks

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...