Splunk Search

How to extract values from a String.

prafulljha
New Member

Hi i have values in a column like AA(15), ABC(20), ADSF(90).Now i need a regular expression which gives me only values before the Bracket"(".
so i should get AA,ABC,ADSF as my output.
Please help.

Tags (1)
0 Karma

dsiob
Communicator

try this:

/*source*/ | eval new=replace(Track,"\([0-9]*\)","")| table Track,new

pjhae
Engager

Hi dsiob,

Thanks, it's working fine.

0 Karma

woodcock
Esteemed Legend

OK, so go back and UpVote and helpful/correct answer and click Accept on the correctest one.

0 Karma

vasanthmss
Motivator

try something like this,

source="ABC" sourcetype="csv"|where Level="Lvl3" AND Track="ATL(27)"|rex field=Track mode=sed "s/([^)]*)//"|table "Dom", Track Level 
V
0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval Track="ATL(27)" 
| eval 'ATL(27)'=Track 
| rex field="Track" mode=sed "s/\([^)]*\)//" 
| rex field='ATL(27)' mode=sed "s/\([^)]*\)//"
| eval "ATLcopy(27)" = Track
| foreach "*copy(*)" [ rename <<FIELD>> AS "<<MATCHSEG1>>copy" ]
0 Karma

prafulljha
New Member

Hi Woodcock,

Can you please let me know what i am doing wrong here.
Basically i want the string value to print when i use it in Table funciton:
So the output should be "AA" when i pass "AA(27)" as input.
Here is my query:
source="ABC" sourcetype="csv"|where Level="Lvl3" and Track="ATL(27)"|rex field="ATL(27)" mode=sed "s/([^)]*)//"|table "Dom","field"

0 Karma

woodcock
Esteemed Legend

I am not at all clear about what you are trying to do but I have updated my answer with a mockup of 3 different guesses all in one search. One of them should be like what you are trying to do. See the updated answer.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

If you want to get rid of the parentheses and the numeric values in them, use something like:

... | rex field=_raw mode=sed "s/\(\d*\)//g"

If you want to do a single field, use the fieldname instead of _raw. The value will be returned without the parenthesis and numbers, leaving the values you want.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this.. It will extract out only the AA, ABC, ADSF.. This will create the a field called FIELD_NAME.. You can change it to whatever name you want

(?<FIELD_NAME>\w+)\(\d+\)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...