Splunk Search

How to extract a substring based on its position within a field?

mcgi906
Explorer

I have a field that is of the form /Code153:4:Item1,Item2,Item3,Item4/Code211:2:Item5,Item6 where I need to extract a substring in the form of Code###:#:Item,Item,Item.... based upon the location of a search. For example, if it was Item 2 I was searching for then the string Code 153:4:Item1,Item2:Item3:Item4 would be returned.

I am stumped on how to accomplish this.

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search | eval yourfield=split(yourfield,"/") | eval filteredVal=mvfilter(match(yourfield,"Item2"))

View solution in original post

somesoni2
Revered Legend

Try like this

your current search | eval yourfield=split(yourfield,"/") | eval filteredVal=mvfilter(match(yourfield,"Item2"))
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...