Splunk Search

How to add string on a field value?

auaave
Communicator

Hi Guys!

I am creating a table with number of errors per robot. The field values of these robots are "IGH2001", "IGH2002" and "IGH2003".
I used a rex command and was able to extract the last 3 digits which are 001, 002 and 003.

Now, I wanted to add "Robot" in front of the 3 digits to have field values of Robot 001 Robot 002 Robot 003.
How can I do that?

Thank you!

Tags (2)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @auaave,

Can you please try something like this, first 4 lines used to generate dummy data only.

| makeresults 
| eval field1="001"
| append [ | makeresults | eval field1="002"]
| append [ | makeresults | eval field1="003"]
| eval newfield="Robot"." ".field1

View solution in original post

harsmarvania57
Ultra Champion

Hi @auaave,

Can you please try something like this, first 4 lines used to generate dummy data only.

| makeresults 
| eval field1="001"
| append [ | makeresults | eval field1="002"]
| append [ | makeresults | eval field1="003"]
| eval newfield="Robot"." ".field1

auaave
Communicator

@harsmarvania57, thanks for your reply! Based on your input, I have written the code as per below. However, I am having this error "Error in 'makeresults' command: This command must be the first command of a search. "

| chart count(IDEVENT) as ERROR_QTY by ERROR_DESC
| rex field=ROBOT "(?(0\d+))"
| makeresults
| eval field1="001"
| append
[| makeresults
| eval field1="002"]
| append
[| makeresults
| eval field1="003"]
| eval newfield="Robot"." ".field1
| sort ERROR_QTY DESC LIMIT=10

0 Karma

harsmarvania57
Ultra Champion

Query which I had provided was generating dummy data so you do not require first 4 lines from my query . Now based on query you have provided, you are not capturing regex output in any field, try something like this (But I am bit surprised that in chart command you are not using field ROBOT then how can you use ROBOT field in rex command after chart command ??

| rex field=ROBOT "(?<extracted_field>(0\d+))" 
| eval extracted_field="Robot"." ".extracted_field 
| chart count(IDEVENT) as ERROR_QTY, values(extracted_field) as extracted_field by ERROR_DESC 
| sort ERROR_QTY DESC LIMIT=10

In above query 001, 002, 003 ... will store into new field called extracted_field and after that we are concatenating Robot with output value in that field.

EDIT: Updated query.

auaave
Communicator

@harsmarvia57, thanks a lot! the last one worked!! 🙂

0 Karma

harsmarvania57
Ultra Champion

You're welcome.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...