Getting Data In

How to split single field value into two different values?

alex389
Engager

Hello,

I'm trying to split a single value of a result which is 5231562. I want to be able to split this number into two different values.

i.e

Field0 5231562 becomes -
Field1 = 52
Field2 = 31562

Thank you

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex field=Field0 "^(?<Field1>\d{2})(?<Field2>\d+)$"

View solution in original post

alex389
Engager

Thank you all

woodcock
Esteemed Legend

Don't forget to UpVote, too!

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=Field0 "^(?<Field1>\d{2})(?<Field2>\d+)$"

renjith_nair
SplunkTrust
SplunkTrust

Hi @alex389,

If you just want to split , you could use substr. Lets know in case you need any logic for the first two digits

|stats count|fields - count|eval Field0=5231562|eval Field1=substr(Field0,0,2),Field2=substr(Field0,3)
Happy Splunking!

niketnilay
Legend

@alex389 if you always want field1 to be first two digits you can write the following rex:

<yourCurrentSearch>
| rex field=field0 "^(?<field1>\d{2})(?<field2>.*)"

Following is a run anywhere search based on sample data and details.

| makeresults
| eval field0="5231562"
| rex field=field0 "^(?<field1>\d{2})(?<field2>.*)"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>