Splunk Search

How to extract a string from each value in a column in my log?

tp92222
Explorer

hi,

I have log with 3 columns

ID....TYPE...... DESC
1.......A............Member Since Year-2015
2...... B............Member Since Year-2014
3...... A............Member Since Year-2014

I only want bold part from field DESC

How to write such a search?

Thanks

0 Karma
1 Solution

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"

View solution in original post

0 Karma

javiergn
Super Champion

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Unanswered questions make me sad 😞

0 Karma

tp92222
Explorer

thanks for help!!!!!

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Assuming that DESC is already a extracted field

your base search | rex field=DESC "Member\sSince\s(?<member_since>.*)"

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

javiergn
Super Champion

Try this. It'll create a new field named year with the information you asked for:

your search here
| rex field=DESC "(?<year>Year\-\d{4})"
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...