Splunk Search

How to extract values from a String.

prafulljha
New Member

Hi i have values in a column like AA(15), ABC(20), ADSF(90).Now i need a regular expression which gives me only values before the Bracket"(".
so i should get AA,ABC,ADSF as my output.
Please help.

Tags (1)
0 Karma

dsiob
Communicator

try this:

/*source*/ | eval new=replace(Track,"\([0-9]*\)","")| table Track,new

pjhae
Engager

Hi dsiob,

Thanks, it's working fine.

0 Karma

woodcock
Esteemed Legend

OK, so go back and UpVote and helpful/correct answer and click Accept on the correctest one.

0 Karma

vasanthmss
Motivator

try something like this,

source="ABC" sourcetype="csv"|where Level="Lvl3" AND Track="ATL(27)"|rex field=Track mode=sed "s/([^)]*)//"|table "Dom", Track Level 
V
0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval Track="ATL(27)" 
| eval 'ATL(27)'=Track 
| rex field="Track" mode=sed "s/\([^)]*\)//" 
| rex field='ATL(27)' mode=sed "s/\([^)]*\)//"
| eval "ATLcopy(27)" = Track
| foreach "*copy(*)" [ rename <<FIELD>> AS "<<MATCHSEG1>>copy" ]
0 Karma

prafulljha
New Member

Hi Woodcock,

Can you please let me know what i am doing wrong here.
Basically i want the string value to print when i use it in Table funciton:
So the output should be "AA" when i pass "AA(27)" as input.
Here is my query:
source="ABC" sourcetype="csv"|where Level="Lvl3" and Track="ATL(27)"|rex field="ATL(27)" mode=sed "s/([^)]*)//"|table "Dom","field"

0 Karma

woodcock
Esteemed Legend

I am not at all clear about what you are trying to do but I have updated my answer with a mockup of 3 different guesses all in one search. One of them should be like what you are trying to do. See the updated answer.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

If you want to get rid of the parentheses and the numeric values in them, use something like:

... | rex field=_raw mode=sed "s/\(\d*\)//g"

If you want to do a single field, use the fieldname instead of _raw. The value will be returned without the parenthesis and numbers, leaving the values you want.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this.. It will extract out only the AA, ABC, ADSF.. This will create the a field called FIELD_NAME.. You can change it to whatever name you want

(?<FIELD_NAME>\w+)\(\d+\)

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...