Splunk Search

How do I get specific words within a text?

shtom
New Member

The below table is what I get from a search on Splunk"

ActiveLoadId
Jabber_for_iOS-12.1.2.270036
Jabber_for_iOS-12.0.1.263155
Jabber_for_Android-12.5.1.276987
Jabber_for_Windows-11.9.3.60004
Jabber_for_Windows-12.5.0.22884

But what i want is to modify the output text under Field "ActiveLoadID" to see the first few characters. Example below:

ActiveLoadId
Jabber_for_iOS
Jabber_for_iOS
Jabber_for_Android
Jabber_for_Windows
Jabber_for_Windows

My current query is:

 "ActiveLoadId=Jabber_for" | rare limit=20000 ActiveLoadId

Appreciate your help!

0 Karma
1 Solution

vnravikumar
Champion

Hi @shtom

Try

your query....|rex field=ActiveLoadId "(?P<ActiveLoadId>.*)-"

View solution in original post

0 Karma

vnravikumar
Champion

Hi @shtom

Try

your query....|rex field=ActiveLoadId "(?P<ActiveLoadId>.*)-"
0 Karma

shtom
New Member

beautiful.....it worked

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...