Splunk Search

How to capture the substring of a dynamic multivalued field?

GaryZ
Path Finder

I am looking to create an acronym from a dynamic string, by capturing the first letter of each broken substring

How do I write the script, so I can capture whatever number of substrings gets generated from the original string?

 

 

ie. "Hello_World_Look_At_Me" => "HWLAM"

"Hello_World" => "HW"

 

I'm thinking of doing the following, but this seems to be pretty lengthy.  Would like to know if there's a more efficient way of getting this done.

| eval txt1 = "Hello_World_Look_At_Me"

| eval tmp = split(txt1, "_")

| eval new_word = substr(mv_index(tmp,1), 1) + ...

 

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming words are always made of alphabetic letters, try something like this

| rex max_match=0 field=txt1 "(?<initial>[a-zA-Z])[a-zA-Z]*_?"
| eval new_word=mvjoin(initial,"")

View solution in original post

GaryZ
Path Finder

Thanks!!! @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming words are always made of alphabetic letters, try something like this

| rex max_match=0 field=txt1 "(?<initial>[a-zA-Z])[a-zA-Z]*_?"
| eval new_word=mvjoin(initial,"")
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...