Installation

Field extraction - only 2 characters

rajkskumar
Explorer

I need to extract two characters to a new field. The query I have written is able to remove the first 6 characters and it retrieves from 7th character till the end. 

Data:

{ 
       typeIdentifier
       value1234567890ABCDEF

}

 

{\"type\":\"Identifier\",\"value\":\"(?:.{6})(?<idCode>.*?)\"}

 

The query returns "7890ABCDEF" whereas I need only "78". Could someone please help me to fix the issue?

 

Tags (1)
0 Karma

saravanan90
Contributor

This may help..

"value:\s+.{6}(?<val>.{2})"

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...