Splunk Search

How to extract a string from each value in a column in my log?

tp92222
Explorer

hi,

I have log with 3 columns

ID....TYPE...... DESC
1.......A............Member Since Year-2015
2...... B............Member Since Year-2014
3...... A............Member Since Year-2014

I only want bold part from field DESC

How to write such a search?

Thanks

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

0 Karma

tp92222
Explorer

thanks for help!!!!!

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Assuming that DESC is already a extracted field

your base search | rex field=DESC "Member\sSince\s(?<member_since>.*)"

------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma

javiergn
SplunkTrust
SplunkTrust

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"

View solution in original post

0 Karma