Splunk Search

How to write regex to extract three digit numbers from a CSV file and assign the values to a new field?

karthikTIL
Path Finder

HI,

I have source file test.csv which has words like "abc-234 " , "456", "df 654", "er567 -ly".
In all the above words, i want to take only three digit numbers and assign to a field called "eng".
Please let me know how would be the regular expression would be?

Tags (2)
1 Solution

MuS
Legend

Hi karthikTIL,

use something like this:

your base search here | rex "(?<eng>\d{3})" | ...

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi karthikTIL,

use something like this:

your base search here | rex "(?<eng>\d{3})" | ...

hope this helps ...

cheers, MuS

karthikTIL
Path Finder

HI MuS,

sorry, i forgot to add.
All my words occur after "Title #:"
e.g. Title #: df 654

so i used,

your base search here | rex "Title #:(?\d{3})" | ...

but it did not give any result

0 Karma

MuS
Legend

Sure this will not work, because this regex does not match and you did not specify a field name for the group.
Why didn't you try the regex I provided? This will catch all 3 digit numbers, no matter what comes before or after.
But if you really need to match only the Title #: numbers use something like this:

your base search here | rex "Title\s\#\:[\s\w\-]+(?<eng>\d{3})" | ...

and please don't use your base search here as your search, this is only a place holder 😉

karthikTIL
Path Finder

Thanks MuS, it worked now.
actually i specified field in my query earlier, but it was not displayed in my query above:)

0 Karma

MuS
Legend

you're welcome. please mark this as answered if the provided answer was correct - thx

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...