How to extract data for a portion of the field?

[CodingMaestro]

Hello Splunk Community, 

So I have a table that has results like below 

 Name               

Tom01

Tom02

Tom03

Tom04

Quin01

Yonah01

Yonah02

I want a query that if the text matches before the numeric' s it will only select the 01 and ignore the other ones.

For example: IF Yonah01 and Yonah02 exist this is a pair so it will exclude Yonah02 and just have Yonah01 

or another one, if there is Tom01, Tom02, Tom03, Tom04 it will exclude everything except for the Tom01.

Thank you. 

[gcusello · Accepted solution]

Hi @CodingMaestro,

if the field structure is chars and two digit at the end, you could use something like this:

<your_search>
| rex field=Name "^(?<subfield>[a-zA-Z]+)"
| stats first(Name) AS Name BY subfield
| table Name

You can test the regex to extract subfield at https://regex101.com/r/D3P9mA/1

Ciao.

Giuseppe

[CodingMaestro]

Thank You