Reporting

Regex: Help with breaking down a string

andres91302
Communicator

Hello everyone,

Thank you for the help in advance.. I would like to break down a string of values into LETTERS and NUMBERS after the "_" character. For example if I the string NEXTTOWN_YU8392 I would want to get LETTERS= YU and NUMBERS equal to 8392 I have tried this code:

| makeresults 
| eval string="DOWN_X9"
| rex field=string "_(?<letters>[A-Z])(?<numbers>\d+)"

 

and it gives me:
letters=X
numbers=9

 

but when I try something like:

| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?<letters>[A-Z])(?<numbers>\d+)"


it returns nothing at all... I will be so thank you if you could help me out find my error please!
what I would like would be:

TESTlettersnumbers
DOWN_XX9XX9
UP_xxx90XXX90
LEFT_tUIJ89tUIJ89

 

thanks guys!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

In your first example your string was DOWN_X9 i.e. only one letter between the underscore _ and the number 9, so it matched your regex. In the second example, all your strings had more than one letter and indeed some were even lower case, which meant they didn't match the regex so no field was extracted.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

 

| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?<letters>[A-Za-z]+)(?<numbers>\d+)"

 

andres91302
Communicator

@ITWhisperer so the "plus" sign was the only thing missing? I'm so sorry sir I will very much appreciate if you could explain to me why it was working with the first example my code but it didn't work for my second one?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your first example your string was DOWN_X9 i.e. only one letter between the underscore _ and the number 9, so it matched your regex. In the second example, all your strings had more than one letter and indeed some were even lower case, which meant they didn't match the regex so no field was extracted.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...