Splunk Search

Extract substring from field

alesSantiago
New Member

Hi,

I'm facing a problem with string extraction . The scenario is as follows: I'm passing an ID from one chart to another form through URL and, before populating it to the new charts, I need to "remove" some additional data from that string.

Let's say that I receive this kind of string ID: "idfromchart(reverse)" through the URL and I need just the "idfromchart" without the "(reverse)" part. First I need to format the id to the correct value, then I'll try to populate it actually...one step at a time 😉

Any help provided it would be really appreciated.
Thanks!

0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Try replace. Maybe something like:

… | replace idfromchart* with idfromchart in yourfieldname

Or…

… | replace "*(reverse)" with "*" in yourfieldname

I'd go with the latter option first, actually.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Try replace. Maybe something like:

… | replace idfromchart* with idfromchart in yourfieldname

Or…

… | replace "*(reverse)" with "*" in yourfieldname

I'd go with the latter option first, actually.

--
Jesse Trucks
Minister of Magic

alesSantiago
New Member

The second option happened to format the ID to what I wanted. Thanks.
Out of this question, would you be able to tell me if the tag supports queries? I'm thinking about how to populate the formatted id and populate it to the rest of the charts through a dropdown.
thanks again!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

For your step1. Formatting of id (assuming the format of the URL parameter is same as your example, means it contains "(" symbol.

* |head 1| eval body="somestring(reverse)" | table body | eval body1=mvindex(split(body,"("),0) |rex field=body "(?<body2>[^(]+)"

you can use any one of body1 or body2 for your formatting.

0 Karma

alesSantiago
New Member

Thanks for your answer.
I did try this solution, but I wasn't able to make it work the way I wanted.
So the reason why I didn't mark it as a valid answer was not about that it might be or not correct (sure it is), it is about my lack of knowledge in regex. It might be useful for somebody else.
thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...