Hi,
in anything else this would seem very simple but I seem to be flummoxed trying to do this in splunk. Probably not helped by having zero regex knowledge.
I have a field that has values in the format: AAAABBCC
I want to return all values that have BB in position 5, if anyone could be so kind as to provide a sample I can then pull it apart and try and work out how it does it.
Thanks.
Hi @mcaulsc,
ok, if you want to search the values "xx" in the fifth and sixth posizion, try something like this:
index=your_index
| eval BB=substr(your_field,5,2)
| search BB="xx"
| table _time your_field BB
Ciao.
Giuseppe
Assuming characters 1-4=A 5-6=B and 7-8=C, the following should work:
| rex field=YourField "(?<A_values>....)(?<B_values>..)(?<C_values>..)
You should now have three fields A_values, B_values, and C_values.
Hi @mcaulsc,
Please try something like this:
index=your_index
| eval BB=substr(your_field,5,2)
| table _time BB
or using a regex:
index=your_index
| rex field=your_field "\w{4}(?<BB>\w{2})\w{2"}
| table _time BB
Ciao.
Giuseppe
thanks, that gets me a list of all the possible values in pos 5 for 2. What I want is the whole value if I have a match.
so if I have AAAABBCC I have a match on BB in pos5,2 so return AAAABBCC
Hi @mcaulsc,
ok, if you want to search the values "xx" in the fifth and sixth posizion, try something like this:
index=your_index
| eval BB=substr(your_field,5,2)
| search BB="xx"
| table _time your_field BB
Ciao.
Giuseppe
Hi @mcaulsc,
good for you, see nect time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉
That's the one, been tying myself in knots with this for far longer than I should and ended up down regex rabbit holes that I didn't need to be down.
Many thanks for the help.