Splunk Search

How to capture only string and remove optional digits with regex

ncrs5699
Explorer

I have a field which has values like below. there are 100+ values for this field, but i just posted 3 sample values. Some values will have digits(6-8) at the end (as shows in the 3rd value- 854623) and some do not have that number. How to capture only the string, but not the number at the end using regex

FKlB2mKprnNYmaeKMLEHuwAAADw --> (for this i need to capture complete string)
XKlB2pQ3Vg7Fc533j7uljgAAAVU --> (for this i need to capture complete string)
FKlB2kZez-O1EvQ8BK-XGAAAAJw-854623 --> (for this i need to capture only the string until jw, i dont need this value -854623)

I tried like this - | rex field=myField (?i)(?P<UUID>.*?)\-(?:\d{6,8}|^.*)
But this is capturing only UUID from the 3rd value, please help

Tags (1)
1 Solution

niketn
Legend

@ncrs5699, add the following replace() eval function | eval extracted_value=replace(myField,"(.*)(\-\d+)$","\1") to your existing search with myField. Following is a run anywhere example based on sample data provided and the explanation for extraction:

| makeresults 
| eval myField="FKlB2mKprnNYmaeKMLEHuwAAADw;XKlB2pQ3Vg7Fc533j7uljgAAAVU;FKlB2kZez-O1EvQ8BK-XGAAAAJw-854623" 
| makemv delim=";" myField 
| mvexpand myField
| eval extracted_value=replace(myField,"(.*)(\-\d+)$","\1")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

OK, now that you have clarified it, try this:

| makeresults 
| eval msg="FKlB2mKprnNYmaeKMLEHuwAAADw FKlB2mKprnNYmaeKMLEHuwAAADw-123 XKlB2pQ3Vg7Fc533j7uljgAAAVU-12345 XKlB2pQ3Vg7Fc533j7uljgAAAVU-123456 XKlB2pQ3Vg7Fc533j7uljgAAAVU-1234567 XKlB2pQ3Vg7Fc533j7uljgAAAVU-12345678 XKlB2pQ3Vg7Fc533j7uljgAAAVU-123456789" 
| makemv msg 
| eval myNewField = replace(msg, "\-\d{6,8}$", "")

ncrs5699
Explorer

this one worked as well. thanks

0 Karma

niketn
Legend

@ncrs5699, add the following replace() eval function | eval extracted_value=replace(myField,"(.*)(\-\d+)$","\1") to your existing search with myField. Following is a run anywhere example based on sample data provided and the explanation for extraction:

| makeresults 
| eval myField="FKlB2mKprnNYmaeKMLEHuwAAADw;XKlB2pQ3Vg7Fc533j7uljgAAAVU;FKlB2kZez-O1EvQ8BK-XGAAAAJw-854623" 
| makemv delim=";" myField 
| mvexpand myField
| eval extracted_value=replace(myField,"(.*)(\-\d+)$","\1")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ncrs5699
Explorer

thank you, it worked.

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
 | eval msg="FKlB2mKprnNYmaeKMLEHuwAAADw;XKlB2pQ3Vg7Fc533j7uljgAAAVU;FKlB2kZez-O1EvQ8BK-XGAAAAJw-854623" 
 | makemv delim=";" msg 
 | mvexpand msg 
 | rex field=msg "\-(?P<output>[\d]+$)"

OR

If you are specific to length of digits

| makeresults 
| eval msg="FKlB2mKprnNYmaeKMLEHuwAAADw;FKlB2mKprnNYmaeKMLEHuwAAADw-3435;XKlB2pQ3Vg7Fc533j7uljgAAAVU-223332;FKlB2kZez-O1EvQ8BK-XGAAAAJw-12234354" 
| makemv delim=";" msg 
| mvexpand msg 
| rex field=msg "\-(?P<output>[\d]{6,8}$)"

New: Check this

| makeresults 
 | eval myField="FKlB2mKprnNYmaeKMLEHuwAAADw;XKlB2pQ3Vg7Fc533j7uljgAAAVU;FKlB2kZez-O1EvQ8BK-XGAAAAJw-854623" 
 | makemv delim=";" myField 
 | mvexpand myField
 | rex field=myField "(?P<output>.*[^-\d]+)"
0 Karma

niketn
Legend

@ncrs5699 first rex proposed by @vnravikumar is more accurate as per your requirement. Also, \- is not required if the requirement is to pull all digits when the field value ends with digits. \d+$

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ncrs5699
Explorer

thank you, i have updated my question to make it more clear, also i have 100+ values for this field

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...