Splunk Search

Replace Eval Function using Regex

Substance82
Path Finder

When using regex how can I take a field formatted as "0012-4250" and only show the 1st and lat 3 digits? I tried the following in which maintains the original output:

| eval AcctCode = replace(AcctCode,"(\d{4}-)(\d{4})","\1\2")
Labels (2)
Tags (1)
0 Karma
1 Solution

Substance82
Path Finder

Nevermind All.  

 

By some miracle I figured it out!

| eval ProdCode = replace(ProdCode,"^(\d)\d{3}-\d(\d{3})","\1xxx-x\2")

View solution in original post

Substance82
Path Finder

Nevermind All.  

 

By some miracle I figured it out!

| eval ProdCode = replace(ProdCode,"^(\d)\d{3}-\d(\d{3})","\1xxx-x\2")

richgalloway
SplunkTrust
SplunkTrust

The current regex takes the first 4 digits and the last 4 digits and then puts them back together, which is why the result does not change.  Try this, which takes the first and last 3 digits and puts them together.

| rex field=AcctCode mode=sed "s/(\d{3})\d-\d(\d{3})/\1\2/"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Substance82
Path Finder

Hi. 

 

Your reply is greatly appreciated, but I must use the eval command to achieve my results. Do you have an eval command solution?

 

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...