Getting Data In

## How to split single field value into two different values?

Engager

Hello,

I'm trying to split a single value of a result which is 5231562. I want to be able to split this number into two different values.

i.e

``````Field0 5231562 becomes -
Field1 = 52
Field2 = 31562
``````

Thank you

Tags (3)
1 Solution
Esteemed Legend

Like this:

``````... | rex field=Field0 "^(?<Field1>\d{2})(?<Field2>\d+)\$"
``````
Engager

Thank you all

Esteemed Legend

Don't forget to `UpVote`, too!

Esteemed Legend

Like this:

``````... | rex field=Field0 "^(?<Field1>\d{2})(?<Field2>\d+)\$"
``````
SplunkTrust

Hi @alex389,

If you just want to split , you could use `substr`. Lets know in case you need any logic for the first two digits

``````|stats count|fields - count|eval Field0=5231562|eval Field1=substr(Field0,0,2),Field2=substr(Field0,3)
``````
Happy Splunking!
Legend

@alex389 if you always want field1 to be first two digits you can write the following rex:

``````<yourCurrentSearch>
| rex field=field0 "^(?<field1>\d{2})(?<field2>.*)"
``````

Following is a run anywhere search based on sample data and details.

``````| makeresults
| eval field0="5231562"
| rex field=field0 "^(?<field1>\d{2})(?<field2>.*)"
``````
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

#### Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

#### Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

#### Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...