Splunk Search

How to extract certain words and exclude words from string?

marinella26
Explorer

Hello,

I want to extract certain words only and exclude that comes after numbers.

ex.
Apple12ed
Apple456ppp
Orange234iw
Banana7ye

expected result:
Apple 
Orange 
Banana 

I have tried below, but the each string has different numbers and words, so the result is not correct.

| eval Fruits = substr(Fruits, 1, len(Fruits)-4)

incorrect Result:
Apple
Apple45
Orange2
Banan


Thanks in advance.

Labels (7)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

I suppose that the words to extract are in a field, so you can use the rex command to extract the word in each field, something like this:

<your_Search>
| rex field=your_field "^(?<word>[A-Za-z]*)"
| table word

Ciao.

Giuseppe

View solution in original post

marinella26
Explorer

There are more than 100 strings, so it is not ideal to use <eval> to create each strings.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @marinella26 ,

I suppose that the words to extract are in a field, so you can use the rex command to extract the word in each field, something like this:

<your_Search>
| rex field=your_field "^(?<word>[A-Za-z]*)"
| table word

Ciao.

Giuseppe

duesser
Path Finder

Maybe using

 

 

 

^(?P<word>[a-zA-Z]+)(?=\d)

 

 

 

would be more exact, as it does not return an empty match on strings that do not start with a letter such as "_Apple". Furthermore, it makes sure the word is followed by a digit and does not match "Apple_" for example.

marinella26
Explorer

@gcusello It worked!! Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...