Splunk Search

How to extract a field based on character count?

eamuncal
Explorer

I have a field name X with the following value: 0123456789.
I want to create another field that is based on the first 4 characters of the field name X.
Then call it Y.

Any idea on how to do this? If its in bash my way would be to use cut -c1-4

Trying the regex and rex to no avail.

Thanks in advance.

emn.

Tags (2)
0 Karma
1 Solution

Ayn
Legend

This should do it:

rex field=X "^(?<Y>\d{4})"

View solution in original post

Ayn
Legend

This should do it:

rex field=X "^(?<Y>\d{4})"

eamuncal
Explorer

This sure did it! Thanks Ayn

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...