Splunk Search

How to fetch values from a string using rex command

Puvi
New Member

Hi,

i have a field with values like AB101, I want to extract 101 separately into a new field

Tags (2)
0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="AB101" 
| rex field=temp "(?P<result>[\d]+)"
0 Karma

kartm2020
Communicator

Try this.
It will fetch the number followed by digits.
| rex field=field_name "A-Z"

If you have non-capital words. try the below

| rex field=field_name "[A-Z]a-z"

0 Karma

renjith_nair
Legend

@Puvi,

Try

|rex field=field_name "(?<digits>\d+)"

where field_name is your field and digits is the new field

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

@Puvi , please accept one of the answers which helped you or let's know if you need further help

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...