Splunk Search

How to capture the substring of a dynamic multivalued field?

GaryZ
Path Finder

I am looking to create an acronym from a dynamic string, by capturing the first letter of each broken substring

How do I write the script, so I can capture whatever number of substrings gets generated from the original string?

 

 

ie. "Hello_World_Look_At_Me" => "HWLAM"

"Hello_World" => "HW"

 

I'm thinking of doing the following, but this seems to be pretty lengthy.  Would like to know if there's a more efficient way of getting this done.

| eval txt1 = "Hello_World_Look_At_Me"

| eval tmp = split(txt1, "_")

| eval new_word = substr(mv_index(tmp,1), 1) + ...

 

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming words are always made of alphabetic letters, try something like this

| rex max_match=0 field=txt1 "(?<initial>[a-zA-Z])[a-zA-Z]*_?"
| eval new_word=mvjoin(initial,"")

View solution in original post

GaryZ
Path Finder

Thanks!!! @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming words are always made of alphabetic letters, try something like this

| rex max_match=0 field=txt1 "(?<initial>[a-zA-Z])[a-zA-Z]*_?"
| eval new_word=mvjoin(initial,"")
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...