Splunk Search

Double value in field

keyu921
Explorer

I am searching windows event log.

Aftre result search complete, Account_Domain contains following value

"-
ABC"

How can I left ABC inside??

| rex field="Account_Domain" mode=sed "s/([0-9]{4}) /\1,,/" not working

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

| rex field=Account_Domain max_match=0 "(?P<Account_Domain>\w+)"

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this

| rex field=Account_Domain max_match=0 "(?P<Account_Domain>\w+)"

View solution in original post

0 Karma

keyu921
Explorer
Become like this

Account_Domain

ALPHA

ALPHA

0 Karma

vnravikumar
Champion

Can you provide some sample data with the expected output?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!