Splunk Search

How to extract a string from each value in a column in my log?

tp92222
Explorer

hi,

I have log with 3 columns

ID....TYPE...... DESC
1.......A............Member Since Year-2015
2...... B............Member Since Year-2014
3...... A............Member Since Year-2014

I only want bold part from field DESC

How to write such a search?

Thanks

0 Karma
1 Solution

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"

View solution in original post

0 Karma

javiergn
Super Champion

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

0 Karma

tp92222
Explorer

thanks for help!!!!!

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Assuming that DESC is already a extracted field

your base search | rex field=DESC "Member\sSince\s(?<member_since>.*)"

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"
0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...