Splunk Search
Highlighted

How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751."

Explorer

Example1

Input: 352322648-1112 : DSSPP-HNWSD-AVI
Output i want : "751.1112"

Example2

Input: 335587620-43300 : DEMO
Output i want: "751.43300"

Thanks

Highlighted

Re: How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751."

SplunkTrust
SplunkTrust

Here's one way.

... | rex "Input: \d+-(?<field>\d+)" | eval newField="751.".field | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How do I get my rex search to extract a string between two strings from a sample below and concat it with the fixed string "751."

SplunkTrust
SplunkTrust

Another way is this (assuming your current input string is available as field input

your current search | eval output=replace(input,"^(.*)(\d+)-(\d+)(\s*:.+)$","751.\3")
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.