Hello Splunk Community,
So I have a table that has results like below
Name
Tom01
Tom02
Tom03
Tom04
Quin01
Yonah01
Yonah02
I want a query that if the text matches before the numeric' s it will only select the 01 and ignore the other ones.
For example: IF Yonah01 and Yonah02 exist this is a pair so it will exclude Yonah02 and just have Yonah01
or another one, if there is Tom01, Tom02, Tom03, Tom04 it will exclude everything except for the Tom01.
Thank you.
Hi @CodingMaestro,
if the field structure is chars and two digit at the end, you could use something like this:
<your_search>
| rex field=Name "^(?<subfield>[a-zA-Z]+)"
| stats first(Name) AS Name BY subfield
| table Name
You can test the regex to extract subfield at https://regex101.com/r/D3P9mA/1
Ciao.
Giuseppe
Hi @CodingMaestro,
if the field structure is chars and two digit at the end, you could use something like this:
<your_search>
| rex field=Name "^(?<subfield>[a-zA-Z]+)"
| stats first(Name) AS Name BY subfield
| table Name
You can test the regex to extract subfield at https://regex101.com/r/D3P9mA/1
Ciao.
Giuseppe
Thank You