Regex for filter in creating pivot

[jpcool]

Hello,

I need to create a pivot where I need to filter the records based on the starting characters of string field i.e only strings starting with characters in the set from A to F and create another pivot for nly strings starting with characters from F to J and so on. I tried with RegEx [a-f] and [a-fA-F] but no luck. I am new to using RegEx with Splunk. Can anyone help how to create filter for field to chose string with only certain characters ?

Thanks,
Jp

[ddrillic]

If we run the following -

| eval data="A11111"
| rex  field=data "(?<user>[A-F]+.*)"  

the generated field user would have value only if the data starts with A-F.

Is this what you are after?

[ryanoconnor]

Can you give some examples of strings you have and what you want to capture? Regex's are much easier to assist with if we can visualize what you're seeing. Also take a look at tools like https://regex101.com/ or http://regexr.com/