- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Substance82
Path Finder
06-27-2024
01:00 PM
When using regex how can I take a field formatted as "0012-4250" and only show the 1st and lat 3 digits? I tried the following in which maintains the original output:
| eval AcctCode = replace(AcctCode,"(\d{4}-)(\d{4})","\1\2")
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Substance82
Path Finder
06-27-2024
03:50 PM
Nevermind All.
By some miracle I figured it out!
| eval ProdCode = replace(ProdCode,"^(\d)\d{3}-\d(\d{3})","\1xxx-x\2")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Substance82
Path Finder
06-27-2024
03:50 PM
Nevermind All.
By some miracle I figured it out!
| eval ProdCode = replace(ProdCode,"^(\d)\d{3}-\d(\d{3})","\1xxx-x\2")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
06-27-2024
01:31 PM
The current regex takes the first 4 digits and the last 4 digits and then puts them back together, which is why the result does not change. Try this, which takes the first and last 3 digits and puts them together.
| rex field=AcctCode mode=sed "s/(\d{3})\d-\d(\d{3})/\1\2/"
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Substance82
Path Finder
06-27-2024
01:35 PM
Hi.
Your reply is greatly appreciated, but I must use the eval command to achieve my results. Do you have an eval command solution?
