Splunk Search

How to extract the last 5 digits in my results as a new field?

Builder

How to extract the last 5 digits from the following results, I need last 5 digits as a new field

00022234
001234
012345
0002345

0 Karma
1 Solution

Legend

Assuming this is a field called numbers. Try this ... | rex field=numbers "(?<numbers>\d{5})$"

View solution in original post

0 Karma

Legend

Assuming this is a field called numbers. Try this ... | rex field=numbers "(?<numbers>\d{5})$"

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!