Dashboards & Visualizations

New column using regex

yifatcy
Path Finder

Hi,

I have the field Queue in my dataset with pattern as follows:

adcams01

adcams02

adcems05

I would like to create a new column in my table which contains 3 letters after adc. For example:

Queue:Site
adcams01ams
adcams02ams
adcems05ems

Is it possible using regex? I know it should include eval but it didn't work for me.

Thank you

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yifatcy 

Try

YOUR_SEARCH
 | rex field=Queue "adc(?<Site>.{3})"

 

Sample Search:

| makeresults | eval _raw="Queue
adcams01
adcams02
adcems05" | multikv forceheader=1 | table Queue | rex field=Queue "adc(?<Site>.{3})"

 

Thanks
Kamlesh Vaghela 

If this reply helps you, an upvote would be appreciated.

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Queue "adc(?<Site>[^\d]+)"

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yifatcy 

Try

YOUR_SEARCH
 | rex field=Queue "adc(?<Site>.{3})"

 

Sample Search:

| makeresults | eval _raw="Queue
adcams01
adcams02
adcems05" | multikv forceheader=1 | table Queue | rex field=Queue "adc(?<Site>.{3})"

 

Thanks
Kamlesh Vaghela 

If this reply helps you, an upvote would be appreciated.

 

yifatcy
Path Finder

Works! thanks

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...