Splunk Search

Extract substring from field

alesSantiago
New Member

Hi,

I'm facing a problem with string extraction . The scenario is as follows: I'm passing an ID from one chart to another form through URL and, before populating it to the new charts, I need to "remove" some additional data from that string.

Let's say that I receive this kind of string ID: "idfromchart(reverse)" through the URL and I need just the "idfromchart" without the "(reverse)" part. First I need to format the id to the correct value, then I'll try to populate it actually...one step at a time 😉

Any help provided it would be really appreciated.
Thanks!

0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Try replace. Maybe something like:

… | replace idfromchart* with idfromchart in yourfieldname

Or…

… | replace "*(reverse)" with "*" in yourfieldname

I'd go with the latter option first, actually.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Try replace. Maybe something like:

… | replace idfromchart* with idfromchart in yourfieldname

Or…

… | replace "*(reverse)" with "*" in yourfieldname

I'd go with the latter option first, actually.

--
Jesse Trucks
Minister of Magic

alesSantiago
New Member

The second option happened to format the ID to what I wanted. Thanks.
Out of this question, would you be able to tell me if the tag supports queries? I'm thinking about how to populate the formatted id and populate it to the rest of the charts through a dropdown.
thanks again!

0 Karma

somesoni2
Revered Legend

For your step1. Formatting of id (assuming the format of the URL parameter is same as your example, means it contains "(" symbol.

* |head 1| eval body="somestring(reverse)" | table body | eval body1=mvindex(split(body,"("),0) |rex field=body "(?<body2>[^(]+)"

you can use any one of body1 or body2 for your formatting.

0 Karma

alesSantiago
New Member

Thanks for your answer.
I did try this solution, but I wasn't able to make it work the way I wanted.
So the reason why I didn't mark it as a valid answer was not about that it might be or not correct (sure it is), it is about my lack of knowledge in regex. It might be useful for somebody else.
thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...