Splunk Search

Removing leading and trailing symbols from a string for numeric conversion

bonddodla
New Member

I have a field Threshold which has a value "+-5%", ">20%", "<30%" etc, which i want to convert into a number.

Could you please suggest how can i remove the leading and trailing symbols so that i can achieve the numeric value only.

Tags (1)
0 Karma
1 Solution

niketn
Legend

@bonddodla try the following rex command on your Threshold field

| rex field="Threshold" "(?<Threshold>\d+)"

Following is a run anywhere example based on sample data provided in the question

| makeresults
| eval Threshold="+-5%,>20%,<30%"
| makemv Threshold delim=","
| mvexpand Threshold
| rex field="Threshold" "(?<Threshold>\d+)"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

bonddodla
New Member

Thanks. It worked

0 Karma

niketn
Legend

@bonddodla try the following rex command on your Threshold field

| rex field="Threshold" "(?<Threshold>\d+)"

Following is a run anywhere example based on sample data provided in the question

| makeresults
| eval Threshold="+-5%,>20%,<30%"
| makemv Threshold delim=","
| mvexpand Threshold
| rex field="Threshold" "(?<Threshold>\d+)"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...