Field Parsing Address for Numbers

[phandnny]

I'm fairly new to Splunk. I have a field (address). How can I parse just the all numbers from an address line to a new field (so I can list it later in a table) ?

i.e. 123 W Smith St #1

Would become:

1231

[vnravikumar]

Hi

Try this also

| makeresults 
| eval address ="123 W Smith St #1" 
| rex field=address max_match=0 "(?P<result>[0-9]+)" 
| eval result= replace(tostring(result),"\s","") 
| table address result

[richgalloway]

This should do it.

... | eval numbers=address | rex field=numbers mode=sed "s/(\D)//g"

[martin_mueller]

Yeah, many roads lead to this particular Rome. Another one:

... | eval numbers = replace(address, "\D+", "")