Splunk Search

Using Regex to break down a string

cindygibbs_08
Communicator

Hello guys I hope you are all having a great week

I work in a hotel chain and we provide transportation services, but unfortunaly for one of the contries where we have bussiness the type of transporation service provided comes in single string and I cant seem to break it down to make sense of it...

The structure of this string goes as follows
 

tvservice63_U8956 
tvservice63_L45
tvservice63_X15
tvservice63_T63

the letter after the "_" represents the type of transportation and the number following is the amount charged

What I want to do is the following

stringserviceBILL
tvservice63_U8956 U8956 
tvservice63_L45L45
tvservice63_X15X15
tvservice63_T63T63

 

separate the type of service and the amount of the bill I know I can use split or rex to separate by the "_" but Im lost at how to tell splunk to get the letter and the amount charged... thank you so much to those who can help me

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

rex will do the job.

| rex field=string "_(?<service>[A-Z])(?<BILL>\d+)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

rex will do the job.

| rex field=string "_(?<service>[A-Z])(?<BILL>\d+)"
---
If this reply helps you, Karma would be appreciated.

cindygibbs_08
Communicator

Speechless, like... I would have never thought it was so easy thank you so much

Tags (1)
0 Karma
Get Updates on the Splunk Community!

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...