How to write an expression that extracts only the first three letters of a string?

[mayank101]

I have a different string named:

1.  GBP:BOOT1STSUNMONTH_MAINT2
2.  AMP:BOOT1STSATMONTH_MAINT4
3.  AMP:USFIMBSWEEKENDSVRSTOP_REBOOT_POSTCHECK_Box

I want to write an expression that extracts only the first three letter of the string and then store AMP, AMS into 1 entity named as AS, other GBP into another entity named EU.
Can you please help me in writing an expression for this, I am quite new to Splunk.

[vnravikumar]

Hi

Try this

| makeresults 
| eval test="GBP:BOOT1STSUNMONTH_MAINT2,AMP:BOOT1STSATMONTH_MAINT4,AMP:USFIMBSWEEKENDSVRSTOP_REBOOT_POSTCHECK_Box" 
| makemv delim="," test 
| mvexpand test 
| rex field=test "(?P<result>^.{0,3})" 
| eval AS = if(result=="AMP" OR result == "AMS", result,"") 
| eval EU = if(result=="GBP", result,"")

[mayank101]

Hi Ravi,
Thanks for the prompt response but the problem is there are many such strings .Its not just these. There are around 1000 of strings that start with AMP or GBP under the field name called entity.I cant incorporate all the strings in the eval test function. Could you help in this case.

[vnravikumar]

For sample purpose, I had mentioned those string in test, replace the same with the actual field in the index

[mayank101]

index="nmr-eis-gl-sysm-amber"
(publisher="gl_autosys_az" entity="*boot" ).My initial query is this..so you want me to replace those string with index ("nmr-eis-gl-sysm-amber" ).So I'm query I will be using index two times