Splunk Search

How to extract certain words and exclude words from string?

marinella26
Explorer

Hello,

I want to extract certain words only and exclude that comes after numbers.

ex.
Apple12ed
Apple456ppp
Orange234iw
Banana7ye

expected result:
Apple 
Orange 
Banana 

I have tried below, but the each string has different numbers and words, so the result is not correct.

| eval Fruits = substr(Fruits, 1, len(Fruits)-4)

incorrect Result:
Apple
Apple45
Orange2
Banan


Thanks in advance.

Labels (7)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

I suppose that the words to extract are in a field, so you can use the rex command to extract the word in each field, something like this:

<your_Search>
| rex field=your_field "^(?<word>[A-Za-z]*)"
| table word

Ciao.

Giuseppe

View solution in original post

marinella26
Explorer

There are more than 100 strings, so it is not ideal to use <eval> to create each strings.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

I suppose that the words to extract are in a field, so you can use the rex command to extract the word in each field, something like this:

<your_Search>
| rex field=your_field "^(?<word>[A-Za-z]*)"
| table word

Ciao.

Giuseppe

duesser
Path Finder

Maybe using

 

 

 

^(?P<word>[a-zA-Z]+)(?=\d)

 

 

 

would be more exact, as it does not return an empty match on strings that do not start with a letter such as "_Apple". Furthermore, it makes sure the word is followed by a digit and does not match "Apple_" for example.

marinella26
Explorer

@gcusello It worked!! Thank you so much.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...