how will i filter rows with specific column specification

[kavyatim]

Hi ,

I have a table called "Database" with column like this :
COD_SC_CSO
51681
11680
11680
11268
11251
I would like to filter rows only where COD_SC_CSO 2 and 3 position is 68. .
For example if COD_SC_CSO =51681(2 and 3 position is 68), i want to filter entire row of COD_SC_CSO =51681

Can any one help me out to do this.

Thanking

[dwaddle]

You are not entirely clear by "filter" if you mean to "keep" or to "throw away" the items with the substring of '68'.

Don't forget, the where command can do almost anything eval can do, but can do comparisons as well. So this should work as well:

source="base_bds_adsl.csv" | where  (substr(COD_SC_CSO,3,2)=68)  

[Ayn · Accepted solution]

Well, you almost got the answer yourself, you just need to reorder your search a bit.

source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | search str=68 | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

[cmeinco]

I'm not sure which is more efficient, but since my brain works in regex, this would also work:

source="base_bds_adsl.csv" | regex COD_SC_CSO="^\d{2}68\d$" | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

[kavyatim]

Its a splunk search question:

For time being my query is as follows:
source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | table str,N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla| where str="68

but i dont want to display str in my table

[cmeinco]

Is this a splunk search question? Or are you asking how to only index the filtered data ?