Hi, @ITWhisperer @bowesmana @niketn
Could you Please help me with my doubt
Query:
"index=71412-cli sourcetype=show_interface | fields type interface operStatus |table type interface operStatus |search interface=port*"
output of the query
type interface
Port-channel Port-channel1
Port-channel Port-channel261
Port-channel Port-channel100
Port-channel Port-channel99.202
Port-channel Port-channel99.200
Port-channel Port-channel99.160
Port-channel Port-channel99.159
Port-channel Port-channel99.158
Port-channel Port-channel99.157
I need to capture only the values after the Port-channel(99.157) from the interface column and create separate column to print only the ids of port-channel
Expected output
type interface port-id
Port-channel Port-channel1 1
Port-channel Port-channel261 261
Port-channel Port-channel100 100
Port-channel Port-channel99.202 99.202
Port-channel Port-channel99.200 99.200
Port-channel Port-channel99.160 99.160
Port-channel Port-channel99.159 99.159
Port-channel Port-channel99.158 99.158
Port-channel Port-channel99.157 99.157
Please help me in solving this doubts
Thanks and regards,
Priya
Hi @priyastalin,
good for You!
Please, accept it for the other people of Community.
Ciao and Happy Splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉
Hi @priyastalin,
try this regex
"index=71412-cli sourcetype=show_interface
| rex field=interface "^Port-channel(?<port_id>.*)"
| table type interface port_id
that you can test at https://regex101.com/r/XtkQiZ/1
Don't use "-" in the field name, but "_".
Ciao.
Giuseppe
Hi @gcusello,
Thank you so much for your input. Itworked fine
Hi @priyastalin,
good for You!
Please, accept it for the other people of Community.
Ciao and Happy Splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉