Splunk Search

Regex field values into new fields

Contributor

Hello Splunkers,

I am trying to take the values from an existing field/value pair and put them into new fields.
host=HOTX003ASA2
host=RECA002JUN1
host=LLCA323PAN2

1st two characters=City
2nd two character=State
3 digits=Site no.
Last 3 characters=FW vendor
Last number=Cluster no.

I setup a regex in regex101.com that grabbed the first two characters successfully "^.{2}" but Splunk gives me the following error: The regex '^\d{2}' does not extract anything.

How do I grab the character pairs as described and put them into their own fields?

Thanks!

Tags (3)
0 Karma
1 Solution

Revered Legend

Try like this

your base search with field host | rex field=host "(?<City>\S{2})(?<State>\S{2})(?<Site_No>\d{3})(?<FW_Vendor>\S{3})(?<Cluster_No>\d)"

View solution in original post

0 Karma

Revered Legend

Try like this

your base search with field host | rex field=host "(?<City>\S{2})(?<State>\S{2})(?<Site_No>\d{3})(?<FW_Vendor>\S{3})(?<Cluster_No>\d)"

View solution in original post

0 Karma

Contributor

Thanks! I think I get it now!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!