Splunk Search

How to write regex to extract three digit numbers from a CSV file and assign the values to a new field?

karthikTIL
Path Finder

HI,

I have source file test.csv which has words like "abc-234 " , "456", "df 654", "er567 -ly".
In all the above words, i want to take only three digit numbers and assign to a field called "eng".
Please let me know how would be the regular expression would be?

Tags (2)
1 Solution

MuS
Legend

Hi karthikTIL,

use something like this:

your base search here | rex "(?<eng>\d{3})" | ...

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi karthikTIL,

use something like this:

your base search here | rex "(?<eng>\d{3})" | ...

hope this helps ...

cheers, MuS

karthikTIL
Path Finder

HI MuS,

sorry, i forgot to add.
All my words occur after "Title #:"
e.g. Title #: df 654

so i used,

your base search here | rex "Title #:(?\d{3})" | ...

but it did not give any result

0 Karma

MuS
Legend

Sure this will not work, because this regex does not match and you did not specify a field name for the group.
Why didn't you try the regex I provided? This will catch all 3 digit numbers, no matter what comes before or after.
But if you really need to match only the Title #: numbers use something like this:

your base search here | rex "Title\s\#\:[\s\w\-]+(?<eng>\d{3})" | ...

and please don't use your base search here as your search, this is only a place holder 😉

karthikTIL
Path Finder

Thanks MuS, it worked now.
actually i specified field in my query earlier, but it was not displayed in my query above:)

0 Karma

MuS
Legend

you're welcome. please mark this as answered if the provided answer was correct - thx

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...