Splunk Search

How to create a field from another field?

lys1030
Explorer

I have a field "F1" with values as following:
alt text
I want to add a filed "F2" with value 'a' to all 'a*', with value 'b' to all 'b*'.
alt text
What should I do?
Thanks in advance!

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi lys1030,

try this little regex:

your base search here | rex field=F1 "(?<F2>[a-zA-Z])" | table F1 F2

Hope this helps ...

cheers, MuS

View solution in original post

woodcock
Esteemed Legend

Like this:

| eval F1 = substr(F2,1,1)

MuS
Legend

Hi lys1030,

try this little regex:

your base search here | rex field=F1 "(?<F2>[a-zA-Z])" | table F1 F2

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...