Splunk Search

How to add string on a field value?

auaave
Communicator

Hi Guys!

I am creating a table with number of errors per robot. The field values of these robots are "IGH2001", "IGH2002" and "IGH2003".
I used a rex command and was able to extract the last 3 digits which are 001, 002 and 003.

Now, I wanted to add "Robot" in front of the 3 digits to have field values of Robot 001 Robot 002 Robot 003.
How can I do that?

Thank you!

Tags (2)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @auaave,

Can you please try something like this, first 4 lines used to generate dummy data only.

| makeresults 
| eval field1="001"
| append [ | makeresults | eval field1="002"]
| append [ | makeresults | eval field1="003"]
| eval newfield="Robot"." ".field1

View solution in original post

harsmarvania57
Ultra Champion

Hi @auaave,

Can you please try something like this, first 4 lines used to generate dummy data only.

| makeresults 
| eval field1="001"
| append [ | makeresults | eval field1="002"]
| append [ | makeresults | eval field1="003"]
| eval newfield="Robot"." ".field1

auaave
Communicator

@harsmarvania57, thanks for your reply! Based on your input, I have written the code as per below. However, I am having this error "Error in 'makeresults' command: This command must be the first command of a search. "

| chart count(IDEVENT) as ERROR_QTY by ERROR_DESC
| rex field=ROBOT "(?(0\d+))"
| makeresults
| eval field1="001"
| append
[| makeresults
| eval field1="002"]
| append
[| makeresults
| eval field1="003"]
| eval newfield="Robot"." ".field1
| sort ERROR_QTY DESC LIMIT=10

0 Karma

harsmarvania57
Ultra Champion

Query which I had provided was generating dummy data so you do not require first 4 lines from my query . Now based on query you have provided, you are not capturing regex output in any field, try something like this (But I am bit surprised that in chart command you are not using field ROBOT then how can you use ROBOT field in rex command after chart command ??

| rex field=ROBOT "(?<extracted_field>(0\d+))" 
| eval extracted_field="Robot"." ".extracted_field 
| chart count(IDEVENT) as ERROR_QTY, values(extracted_field) as extracted_field by ERROR_DESC 
| sort ERROR_QTY DESC LIMIT=10

In above query 001, 002, 003 ... will store into new field called extracted_field and after that we are concatenating Robot with output value in that field.

EDIT: Updated query.

auaave
Communicator

@harsmarvia57, thanks a lot! the last one worked!! 🙂

0 Karma

harsmarvania57
Ultra Champion

You're welcome.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...