how can i trim until a specific character?

[ygdrassil]

Hello,

I got a field that has a format and a value like this "S01-3101" and sometimes a value like this "S01-301"
i just want to get the value of 01 near the letter S and i want to trim the S and "-3101" .

My idea is to trim the value after the "-" and itself, but i dont know if it is possible.

Thank you for your answers!!!!!

[ygdrassil]

Thank you for the answers , i already answer this question by using substrt()

[niketn]

@ygdrassil, please go ahead and mention your approach to fix the issue and Accept the same as answer.

In your question you have first mentioned that you are interested in digits after S and then also digits after dot (.)

<YourBaseSearch> yourFieldName=*
| rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)"

If the field value is present on the events you are interested in and you always need this extraction you should check out Field Extraction Knowledge Objects (this way the regular expression based field extraction will persist as Knowledge Object and can be easily maintained and reused.).

Following are some of Splunk Documentation reference for the same: http://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Extractfieldswithsearchcommands
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields
Following is a run anywhere search based on sample data provided:

| makeresults
| eval yourFieldName="S01-3101,S01-301"
| makemv yourFieldName delim="," 
| mvexpand yourFieldName
| rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)"

[493669]

try this regex:

   ... |rex field=<fieldname>"^.(?<test>\d+)"

Try this run anywhere search:

|makeresults|eval _raw="S01-3101"|rex field=_raw"^.(?<test>\d+)"