how to fetch the filed using regex

[priyastalin]

Hi, @ITWhisperer @bowesmana @niketnilay 

@dmarling 

Could you Please help me with my doubt

Query:

"index=71412-cli sourcetype=show_interface | fields type interface operStatus |table type interface operStatus |search interface=port*"

output of the query

type                       interface
Port-channel     Port-channel1
Port-channel     Port-channel261
Port-channel     Port-channel100
Port-channel     Port-channel99.202
Port-channel     Port-channel99.200
Port-channel     Port-channel99.160
Port-channel     Port-channel99.159
Port-channel     Port-channel99.158
Port-channel    Port-channel99.157

I need to capture only the values after the Port-channel(99.157) from the interface column and create separate column to print only the ids of port-channel

Expected output

type                       interface                                  port-id
Port-channel     Port-channel1                          1
Port-channel     Port-channel261                     261
Port-channel     Port-channel100                    100
Port-channel     Port-channel99.202             99.202
Port-channel     Port-channel99.200             99.200
Port-channel     Port-channel99.160             99.160
Port-channel     Port-channel99.159             99.159
Port-channel     Port-channel99.158             99.158
Port-channel    Port-channel99.157              99.157

Please help me in solving this doubts

Thanks and regards,

Priya

[gcusello]

Hi @priyastalin,

try this regex

"index=71412-cli sourcetype=show_interface 
| rex field=interface "^Port-channel(?<port_id>.*)"
| table type interface  port_id

that you can test at https://regex101.com/r/XtkQiZ/1

Don't use "-" in the field name, but "_".

Ciao.

Giuseppe

[priyastalin]

Hi @gcusello,

Thank you so much for your input. Itworked fine

[gcusello · Accepted solution]

Hi @priyastalin,

good for You!

Please, accept it for the other people of Community.

Ciao and Happy Splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉