Getting Data In

Field Parsing Address for Numbers

phandnny
Engager

I'm fairly new to Splunk. I have a field (address). How can I parse just the all numbers from an address line to a new field (so I can list it later in a table) ?

i.e. 123 W Smith St #1

Would become:

1231

0 Karma

vnravikumar
Champion

Hi

Try this also

| makeresults 
| eval address ="123 W Smith St #1" 
| rex field=address max_match=0 "(?P<result>[0-9]+)" 
| eval result= replace(tostring(result),"\s","") 
| table address result
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it.

... | eval numbers=address | rex field=numbers mode=sed "s/(\D)//g"
---
If this reply helps you, an upvote would be appreciated.

martin_mueller
SplunkTrust
SplunkTrust

Yeah, many roads lead to this particular Rome. Another one:

... | eval numbers = replace(address, "\D+", "")
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!