Splunk Search

How to extract IDs?

beepbop
Explorer

I have a field called APM_ID and i want to get the output for only APMs from this field (for eg: A1002, A0001) and want to group the rest of the output as "shared service". What query can i write for the desired output?

APM_ID
ABCDE-FVG-HH
HBBB-NDBXB-SM
A1001
SBSKS
A0002
JJSKM

A0009

A2002
Labels (4)
0 Karma

woodcock
Esteemed Legend

|makeresults
| eval APM_ID = "ABCDE-FVG-HH HBBB-NDBXB-SM A1001 SBSKS A0002 JJSKM"
| rex max_match=0 field=APM_ID "(?<APM>A\d{4})"

rut
Path Finder

@beepbop  The following would group by id or "shared service", the regex may need to be a bit more strict depending on the field values.

 

| eval APM_ID_GROUP=if(match(APM_ID, "^[A-Z]\d+$"), APM_ID, "shared service")
| stats values(APM_ID) as APM_ID by APM_ID_GROUP

 

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...