Splunk Search

Extract one word

edfigue
Engager

Hello, 

How can I extract debitsksvrvru7 from this query:

sndb(1p_debitsksvrvru/-363877568/localhost_debitsksvrvru7)pass:len=152

field name= Description

thank you

Labels (1)
0 Karma
1 Solution

rnowitzki
Builder

Hi @edfigue,

If the string looks similiar all the time, you could do it on searchtime with rex:

 

| rex field=Description "\/localhost\_(?<new_field>\S*)\)"

 


If it is not everytime "localhost_" in front of the data you need you would have to change it to something more generic.

Hope it gives you an idea.
BR
Ralph

--
Karma and/or Solution tagging appreciated.


--
Karma and/or Solution tagging appreciated.

View solution in original post

rnowitzki
Builder

Hi @edfigue,

If the string looks similiar all the time, you could do it on searchtime with rex:

 

| rex field=Description "\/localhost\_(?<new_field>\S*)\)"

 


If it is not everytime "localhost_" in front of the data you need you would have to change it to something more generic.

Hope it gives you an idea.
BR
Ralph

--
Karma and/or Solution tagging appreciated.


--
Karma and/or Solution tagging appreciated.

View solution in original post

edfigue
Engager

Thank you, that works!! 🙂 

0 Karma