Get just 7 characters of field to search

[dlcrooks]

I have a userID with 9 characters and want to search a lookup with just 7 characters. I have tried to use RegEx but it just searches that many characters instead of assigning it to the field. Any ideas?

[mayurr98]

you can do this using rex as well

Try this run anywhere search

| makeresults 
| eval userID="dlcrooks mayurjadhav splunkninja dlcrook123 dl123crooks" 
| makemv userID 
| mvexpand userID 
| rex field=userID "(?<userID>\w{7})"

In your environment, you should write

index=<your_index> 
| rex field=userID "(?<userID>\w{7})"

let me know if this helps!

[493669 · Accepted solution]

Try:

 <base search>|eval userID =substr(userID,1,7)

Hope this helps!

[dlcrooks]

Thanks! It works!

[493669]

@dlcrooks, please accept answer so that it will no longer open