Getting Data In

How to split single field value into two different values?

Engager

Hello,

I'm trying to split a single value of a result which is 5231562. I want to be able to split this number into two different values.

i.e

``````Field0 5231562 becomes -
Field1 = 52
Field2 = 31562
``````

Thank you

Tags (3)
1 Solution
Esteemed Legend

Like this:

``````... | rex field=Field0 "^(?<Field1>\d{2})(?<Field2>\d+)\$"
``````
Engager

Thank you all

Esteemed Legend

Don't forget to `UpVote`, too!

Esteemed Legend

Like this:

``````... | rex field=Field0 "^(?<Field1>\d{2})(?<Field2>\d+)\$"
``````
Legend

Hi @alex389,

If you just want to split , you could use `substr`. Lets know in case you need any logic for the first two digits

``````|stats count|fields - count|eval Field0=5231562|eval Field1=substr(Field0,0,2),Field2=substr(Field0,3)
``````
Happy Splunking!
Legend

@alex389 if you always want field1 to be first two digits you can write the following rex:

``````<yourCurrentSearch>
| rex field=field0 "^(?<field1>\d{2})(?<field2>.*)"
``````

Following is a run anywhere search based on sample data and details.

``````| makeresults
| eval field0="5231562"
| rex field=field0 "^(?<field1>\d{2})(?<field2>.*)"
``````
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...