Splunk Search

How to fetch values from a string using rex command

Puvi
New Member

Hi,

i have a field with values like AB101, I want to extract 101 separately into a new field

Tags (2)
0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="AB101" 
| rex field=temp "(?P<result>[\d]+)"
0 Karma

kartm2020
Communicator

Try this.
It will fetch the number followed by digits.
| rex field=field_name "A-Z"

If you have non-capital words. try the below

| rex field=field_name "[A-Z]a-z"

0 Karma

renjith_nair
Legend

@Puvi,

Try

|rex field=field_name "(?<digits>\d+)"

where field_name is your field and digits is the new field

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

@Puvi , please accept one of the answers which helped you or let's know if you need further help

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...