Splunk Search

New field from search results

nburgess1
Explorer

Hi,

I have a field called "OrgCode" with data like "L6" "L9" "G6" "K6" "K4", which is departments L G and K. I need to get a new field for each department.

Thanks

Tags (1)
0 Karma

nburgess1
Explorer

The substr method returns a new field with the first character of the OrgCode field. What I need is a field for DeptL where only the OrgCodes that start with L are in it. Then a DeptK field with only the OrgCodes that start with K are in it, and so on. This seems logical to me but doesn't work:

 eval DeptA=[search OrgCode=A*]
0 Karma

somesoni2
Revered Legend

After the field Department/dept is created, you will be able to filter records for a single department.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming the department code is always the first character of OrgCode, one of these should do the job.

... | rex field=OrgCode "(?<dept>\w)" | ...

... | eval dept = substr(OrgCode, 1, 1) | ...
---
If this reply helps you, Karma would be appreciated.

somesoni2
Revered Legend

Try this

your current search which include field OrgCode | eval Deparment=replace(OrgCode,"^([A-z]+)\d+","\1")
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...