Splunk Search

Rex to select number from string

Explorer

Hi All,

I am trying to select numbers from a field using Rex, but I cannot seem to figure it out.

Basically the values that i have in the field are:

XX (432)
FH02 (2356)
YR01 (855553)

I want to be able to select the number in the () - this number can be of any length.

How can I do this?

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can try something like this

<your base search> | rex field=<fieldname> "\s\((?<number>[^\)]+)"

let me know if this helps!

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You can try something like this

<your base search> | rex field=<fieldname> "\s\((?<number>[^\)]+)"

let me know if this helps!

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

try this if the field is multivalue

| rex field=<fieldname> max_match=0 "\s\((?<number>[^\)]+)"
0 Karma

Explorer

thank you! worked perfectly!

0 Karma

Super Champion

Hi @abbam,
try this:

|rex field=<fieldname> "\((?<number>\d+)"

try this run anywhere search:

|makeresults|eval sample="XX (432)"|rex field=sample "\((?<number>\d+)"
0 Karma

Explorer

Thank you!

How would you do it if the field was multivalue?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!