Splunk Search

How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751."

Veeruswathi
Explorer

Example1

Input: 352322648-1112 : D_SSPP-HNW_SD-AVI
Output i want : "751.1112"

Example2

Input: 335587620-43300 : DEMO
Output i want: "751.43300"

Thanks

somesoni2
Revered Legend

Another way is this (assuming your current input string is available as field input

your current search | eval output=replace(input,"^(.*)(\d+)-(\d+)(\s*:.+)$","751.\3")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way.

... | rex "Input: \d+-(?<field>\d+)" | eval newField="751.".field | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...