Splunk Search

How to achieve conditional formatting of values with eval if and regex?


Hello everyone,

I have the following field and example value: sourcePort=514.000

I'd like to format these fields in such a way, that only the first digits until the point are kept. Furthermore, this should only apply to a certain group of events (group one). 
before: sourcePort=514.000
after:    sourcePort=514

What I have until now:
| eval sourcePort=if(group=one, regex part, sourcePort)

The regex to match only the digits is  ^\d{1,5}
However, I am unsure how to work with the regex and if it is even possible to achieve my goal using this.

Thanks in advance

Labels (4)
0 Karma

Splunk Employee
Splunk Employee

I would use split and mvindex instead of rex:

| eval sourcePort=if(group=one,mvindex(split(sourcePort,"."),0),sourcePort)
0 Karma


You can use | rex to achieve that:

|rex field=sourcePort "(?<src_port>\d{1,5})"
|eval sourcePort=if(group=one,src_port,sourcePort)


Hope I was able to help you. If so, some karma would be appreciated.
0 Karma


You can use the replace function (which supports regex)

| eval sourcePort=if(group=one,replace(sourcePort,"(?<p>\d{1,5})\.(?<q>.*)","\1"),sourcePort)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...