Splunk Search
Highlighted

How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751."

Explorer

Example1

Input: 352322648-1112 : DSSPP-HNWSD-AVI
Output i want : "751.1112"

Example2

Input: 335587620-43300 : DEMO
Output i want: "751.43300"

Thanks

Highlighted

Re: How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751."

SplunkTrust
SplunkTrust

Here's one way.

... | rex "Input: \d+-(?<field>\d+)" | eval newField="751.".field | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751."

SplunkTrust
SplunkTrust

Another way is this (assuming your current input string is available as field input

your current search | eval output=replace(input,"^(.*)(\d+)-(\d+)(\s*:.+)$","751.\3")
0 Karma