Splunk Search

How to extract a substring based on its position within a field?

mcgi906
Explorer

I have a field that is of the form /Code153:4:Item1,Item2,Item3,Item4/Code211:2:Item5,Item6 where I need to extract a substring in the form of Code###:#:Item,Item,Item.... based upon the location of a search. For example, if it was Item 2 I was searching for then the string Code 153:4:Item1,Item2:Item3:Item4 would be returned.

I am stumped on how to accomplish this.

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search | eval yourfield=split(yourfield,"/") | eval filteredVal=mvfilter(match(yourfield,"Item2"))

View solution in original post

somesoni2
Revered Legend

Try like this

your current search | eval yourfield=split(yourfield,"/") | eval filteredVal=mvfilter(match(yourfield,"Item2"))
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...