Reporting

Regex: Help with breaking down a string

andres91302
Communicator

Hello everyone,

Thank you for the help in advance.. I would like to break down a string of values into LETTERS and NUMBERS after the "_" character. For example if I the string NEXTTOWN_YU8392 I would want to get LETTERS= YU and NUMBERS equal to 8392 I have tried this code:

| makeresults 
| eval string="DOWN_X9"
| rex field=string "_(?<letters>[A-Z])(?<numbers>\d+)"

 

and it gives me:
letters=X
numbers=9

 

but when I try something like:

| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?<letters>[A-Z])(?<numbers>\d+)"


it returns nothing at all... I will be so thank you if you could help me out find my error please!
what I would like would be:

TESTlettersnumbers
DOWN_XX9XX9
UP_xxx90XXX90
LEFT_tUIJ89tUIJ89

 

thanks guys!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

In your first example your string was DOWN_X9 i.e. only one letter between the underscore _ and the number 9, so it matched your regex. In the second example, all your strings had more than one letter and indeed some were even lower case, which meant they didn't match the regex so no field was extracted.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

 

| makeresults 
| eval TEST = "DOWN_XX9 UP_xxx90 LEFT_tUIJ89" 
| makemv TEST 
| mvexpand TEST
| rex field=TEST "_(?<letters>[A-Za-z]+)(?<numbers>\d+)"

 

andres91302
Communicator

@ITWhisperer so the "plus" sign was the only thing missing? I'm so sorry sir I will very much appreciate if you could explain to me why it was working with the first example my code but it didn't work for my second one?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your first example your string was DOWN_X9 i.e. only one letter between the underscore _ and the number 9, so it matched your regex. In the second example, all your strings had more than one letter and indeed some were even lower case, which meant they didn't match the regex so no field was extracted.

Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...