Splunk Search

How to extract a string from each value in a column in my log?

tp92222
Explorer

hi,

I have log with 3 columns

ID....TYPE...... DESC
1.......A............Member Since Year-2015
2...... B............Member Since Year-2014
3...... A............Member Since Year-2014

I only want bold part from field DESC

How to write such a search?

Thanks

0 Karma
1 Solution

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"

View solution in original post

0 Karma

javiergn
Super Champion

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

0 Karma

tp92222
Explorer

thanks for help!!!!!

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Assuming that DESC is already a extracted field

your base search | rex field=DESC "Member\sSince\s(?<member_since>.*)"

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"
0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...