Splunk Search

How to match and filter by substr?

jaj
Path Finder

I have a log where

labelData=123-345

or

lableData=123

How I want to ignore the -345 and just keep the first 3 characters and report on the occurances. The above would count for two occurrences for labelData=123.

I can't seem to figure this out using:

source=*//logs/stdout.log class=myClass | fields labelData | eval newStuff=substr(labelData, 1, 43 | stats count by newStuff |  sort count | reverse

Input Note: labelData could also be 456-789. Basically, i just want to match/substr the first 3 characters.

Tags (2)
0 Karma
1 Solution

lukejadamec
Super Champion

You can try

source=*//logs/stdout.log class=myClass | fields labelData |regex lableData="123.*" | stats count by labelData | sort count | reverse

This will give you the full string in the results, but the results will only include values with the substring.

If you want to create a new field, then use rex.

source=*//logs/stdout.log class=myClass | fields labelData | rex field=labelData "^(?P<newStuff>123).*" | stats count by newStuff | sort count | reverse

View solution in original post

aishelm
New Member

This is a different answer inspired by above question and responses.

index="indexname" Type="Error"| eval messageInit=substr(Message, 1, 25)| top limit=20 messageInit

0 Karma

lukejadamec
Super Champion

You can try

source=*//logs/stdout.log class=myClass | fields labelData |regex lableData="123.*" | stats count by labelData | sort count | reverse

This will give you the full string in the results, but the results will only include values with the substring.

If you want to create a new field, then use rex.

source=*//logs/stdout.log class=myClass | fields labelData | rex field=labelData "^(?P<newStuff>123).*" | stats count by newStuff | sort count | reverse

lukejadamec
Super Champion

For multiple possibilities you would use the OR command for regex, which is the pipe |. For the first three characters only, use the "starts with" symbol, otherwise known as the carrot ^. I'm assuming you mean exactly 456 or 789.

|regex lableData="^456|^789"

To grab just the one that starts with 789, remove the OR.

|regex lableData="^789"

0 Karma

jaj
Path Finder

QQ: what if the input was 456-789 or 789-012? how could I use a regex to extract the first three characters only?

0 Karma

lukejadamec
Super Champion

If you have multiple substrings to capture, then you can do that also.

0 Karma

jaj
Path Finder

thanks again!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...