Splunk Search

How to use substr to extract the first character of a string and keep all characters up until the first space character?

bhicks32
Explorer

I have a string nadcwppcxicc01x CPU Usage has exceeded the threshold for 30 minutes &I where I would like to create a new column and extract from the string where it would show nadcwppcxicc01x only. I know this would be possible using substr(tablename,1,15), however, I have other strings that differ in length.

Any help would be appreciated!

0 Karma
1 Solution

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi bhicks32

Use the "rex" command. It's much more flexible than substr.

For this string it would look like this:

 YOURSEARCH | rex field=YOURFIELD "(?<NEWFIELD>[^\s]+)"

If you are not entirely familiar with regex I can recommend this site as a reference:

http://regexr.com/

If this works, please mark as answered.

j

View solution in original post

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi bhicks32

Use the "rex" command. It's much more flexible than substr.

For this string it would look like this:

 YOURSEARCH | rex field=YOURFIELD "(?<NEWFIELD>[^\s]+)"

If you are not entirely familiar with regex I can recommend this site as a reference:

http://regexr.com/

If this works, please mark as answered.

j

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...