Splunk Search

Double value in field

keyu921
Explorer

I am searching windows event log.

Aftre result search complete, Account_Domain contains following value

"-
ABC"

How can I left ABC inside??

| rex field="Account_Domain" mode=sed "s/([0-9]{4}) /\1,,/" not working

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

| rex field=Account_Domain max_match=0 "(?P<Account_Domain>\w+)"

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this

| rex field=Account_Domain max_match=0 "(?P<Account_Domain>\w+)"
0 Karma

keyu921
Explorer
Become like this

Account_Domain

ALPHA

ALPHA

0 Karma

vnravikumar
Champion

Can you provide some sample data with the expected output?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>