Dashboards & Visualizations

New column using regex

yifatcy
Path Finder

Hi,

I have the field Queue in my dataset with pattern as follows:

adcams01

adcams02

adcems05

I would like to create a new column in my table which contains 3 letters after adc. For example:

Queue:Site
adcams01ams
adcams02ams
adcems05ems

Is it possible using regex? I know it should include eval but it didn't work for me.

Thank you

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yifatcy 

Try

YOUR_SEARCH
 | rex field=Queue "adc(?<Site>.{3})"

 

Sample Search:

| makeresults | eval _raw="Queue
adcams01
adcams02
adcems05" | multikv forceheader=1 | table Queue | rex field=Queue "adc(?<Site>.{3})"

 

Thanks
Kamlesh Vaghela 

If this reply helps you, an upvote would be appreciated.

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Queue "adc(?<Site>[^\d]+)"

kamlesh_vaghela
SplunkTrust
SplunkTrust

@yifatcy 

Try

YOUR_SEARCH
 | rex field=Queue "adc(?<Site>.{3})"

 

Sample Search:

| makeresults | eval _raw="Queue
adcams01
adcams02
adcems05" | multikv forceheader=1 | table Queue | rex field=Queue "adc(?<Site>.{3})"

 

Thanks
Kamlesh Vaghela 

If this reply helps you, an upvote would be appreciated.

 

yifatcy
Path Finder

Works! thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...