Splunk Search

How to extract a string from each value in a column in my log?

tp92222
Explorer

hi,

I have log with 3 columns

ID....TYPE...... DESC
1.......A............Member Since Year-2015
2...... B............Member Since Year-2014
3...... A............Member Since Year-2014

I only want bold part from field DESC

How to write such a search?

Thanks

0 Karma
1 Solution

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"

View solution in original post

0 Karma

javiergn
Super Champion

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

0 Karma

tp92222
Explorer

thanks for help!!!!!

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Assuming that DESC is already a extracted field

your base search | rex field=DESC "Member\sSince\s(?<member_since>.*)"

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...