Hello Talented People of the wordl!
I hope you are having a great day, I wish to know if there is a way to have a YES or NOT output of the number of digits in each row is greater than a certain limit, for example: I want the column MET equal to true if the number of digits in the raws of the field ID is greater than 9 .. kind of like this:
ID | MET |
123456789 | NOT |
548554569362 | YES |
14521421 | NOT |
1254 | NOT |
4858466358475248 | YES |
lets say that my search begings as follows:
index="medic_dni" ID=* | field ID
#######################################################################
STAGE 2=
I would wonder how would the code would have to look like if the column ID would show some values witha string followed by the (-) sign and then a string of numbers something like this: ID-47855478554 OR IDUSA-47854785545 or something like this: IDSPAIN-7854545454
How can I obtain the following table
ID | ID_ONLY_NUMBERS | NUMBERS_GREATER_THAN_9 |
ID-47855478554841 | 47855478554 | YES |
IDUSA-47854785545521972 | 47854785545 | YES |
IDSPAIN-785454545474588 | 7854545454 | YES |
THANK YOU SO SO MUCH TO ANYONE WHO WOULD LIKE TO HELP I TRULLY FROM THE BOTTOM OF MY HEART THANK YOU
I'm assuming the ID_ONLY_NUMBERS column in your example is not what you would expect with the data in your ID column as the numbers are not the same, however, you can paste this example to a search window which simulates your data.
The last two lines of the search will give you what you need.
| makeresults
| eval _raw="ID
ID-47855478554841
IDUSA-47854785545521972
IDSPAIN-785454545474588
IDUK-123456789"
| multikv forceheader=1
| fields - _time linecount _raw
| rex field=ID "[^-]*-(?<ID_ONLY_NUMBERS>\d+)"
| eval NUMBERS_GREATER_THAN_9=if(len(ID_ONLY_NUMBERS)>9,"YES","NO")
Hope this helps
I'm assuming the ID_ONLY_NUMBERS column in your example is not what you would expect with the data in your ID column as the numbers are not the same, however, you can paste this example to a search window which simulates your data.
The last two lines of the search will give you what you need.
| makeresults
| eval _raw="ID
ID-47855478554841
IDUSA-47854785545521972
IDSPAIN-785454545474588
IDUK-123456789"
| multikv forceheader=1
| fields - _time linecount _raw
| rex field=ID "[^-]*-(?<ID_ONLY_NUMBERS>\d+)"
| eval NUMBERS_GREATER_THAN_9=if(len(ID_ONLY_NUMBERS)>9,"YES","NO")
Hope this helps
@bowesmana hey man! I am not going to waste any time taking your answer as the solution because you nailed it! 10/10 I have to praise you!
I would be so thankful if you could please tell me how this regular expression works as I cant seem to find documentation about it
| rex field=ID "[^-]*-(?<ID_ONLY_NUMBERS>\d+)"
and this one
| multikv forceheader=1
thank you so much my friend
The rex command is documented here
https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/SearchReference/Rex
as for regular expressions, there are many sites that will help you learn about those
This is a good site for testing regular expressions
You can see how the regex works from that rex command with that site
As for multikv, that's also documented on the Splunk site above. It's quite commonly used in examples here to set up some data.