regex substr help

[mcaulsc]

Hi,

in anything else this would seem very simple but I seem to be flummoxed trying to do this in splunk. Probably not helped by having zero regex knowledge.

I have a field that has values in the format:  AAAABBCC

I want to return all values that have BB in position 5, if anyone could be so kind as to  provide a sample I can then pull it apart and try and work out how it does it.

Thanks.

[solarboyz1]

Assuming characters 1-4=A 5-6=B and 7-8=C, the following should work:

| rex field=YourField "(?<A_values>....)(?<B_values>..)(?<C_values>..)

You should now have three fields A_values, B_values, and C_values.

[gcusello]

Hi @mcaulsc,

Please try something like this:

index=your_index
| eval BB=substr(your_field,5,2)
| table _time BB

or using a regex:

index=your_index
| rex field=your_field "\w{4}(?<BB>\w{2})\w{2"}
| table _time BB

Ciao.

Giuseppe

[mcaulsc]

thanks, that gets me a list of all the possible values in pos 5 for 2. What I want is the whole value if I have a match.

so if I have AAAABBCC I have a match on BB in pos5,2 so return AAAABBCC

[gcusello · Accepted solution]

Hi @mcaulsc,

ok, if you want to search the values "xx" in the fifth and sixth posizion, try something like this:

index=your_index
| eval BB=substr(your_field,5,2)
| search BB="xx"
| table _time your_field BB

 Ciao.

Giuseppe

[gcusello]

Hi @mcaulsc,

good for you, see nect time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[mcaulsc]

That's the one, been tying myself in knots with this for far longer than I should and ended up down regex rabbit holes that I didn't need to be down.
Many thanks for the help.