Splunk Search

How to extract certain words and exclude words from string?

marinella26
Explorer

Hello,

I want to extract certain words only and exclude that comes after numbers.

ex.
Apple12ed
Apple456ppp
Orange234iw
Banana7ye

expected result:
Apple 
Orange 
Banana 

I have tried below, but the each string has different numbers and words, so the result is not correct.

| eval Fruits = substr(Fruits, 1, len(Fruits)-4)

incorrect Result:
Apple
Apple45
Orange2
Banan


Thanks in advance.

Labels (7)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

I suppose that the words to extract are in a field, so you can use the rex command to extract the word in each field, something like this:

<your_Search>
| rex field=your_field "^(?<word>[A-Za-z]*)"
| table word

Ciao.

Giuseppe

View solution in original post

marinella26
Explorer

There are more than 100 strings, so it is not ideal to use <eval> to create each strings.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

I suppose that the words to extract are in a field, so you can use the rex command to extract the word in each field, something like this:

<your_Search>
| rex field=your_field "^(?<word>[A-Za-z]*)"
| table word

Ciao.

Giuseppe

duesser
Path Finder

Maybe using

 

 

 

^(?P<word>[a-zA-Z]+)(?=\d)

 

 

 

would be more exact, as it does not return an empty match on strings that do not start with a letter such as "_Apple". Furthermore, it makes sure the word is followed by a digit and does not match "Apple_" for example.

marinella26
Explorer

@gcusello It worked!! Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...