Splunk Search
Highlighted

How do I split/extract these string values to only use part of the string for a field in my search?

Engager

Here are some eventNames: 2022-NO_USER_IN_SESSION, 1022-DRR_INFO, ...
I need the values like: NO_USER_IN_SESSION, 1022-DRR_INFO (so eventName=NO_USER_IN_SESSION)
How to split the eventNames (2022-NOUSERINSESSION, 1022-DRRINFO)

index=app sourcetype=Epc*Event splunk_server_group=ewe sourcetype=EpcPromotionsEvent  eventName=?
0 Karma
Highlighted

Re: How do I split/extract these string values to only use part of the string for a field in my search?

SplunkTrust
SplunkTrust

What are the criteria for separating eventNames?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How do I split/extract these string values to only use part of the string for a field in my search?

Motivator

use regular expression to do it .

Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

http://regexone.com/ - this is a great interactive tutorial
https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
Splunk Regular Expressions - docs are great
Regular Expression Tutorial