Getting Data In

Extracting everything but numbers from _raw message in props.conf

cpeteman
Contributor

I want to extract all characters but digits and have that as a new field. I've done this with easy in search:

|rex mode=sed "/s\d+//g" | rename _raw AS new_field

but this will not let me see the original _raw message nor does props.conf seem to be able to use one field in a new extraction so I cant extract (copy) _raw and the get rid of numbers using SEDCMD. How do I do this? help please???

Tags (2)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

could this be a good thing?

your_base_search | eval new_field = _raw | rex field=new_field mode=sed "s/\d+//g" | stats c by new_field

/k

View solution in original post

kristian_kolb
Ultra Champion

could this be a good thing?

your_base_search | eval new_field = _raw | rex field=new_field mode=sed "s/\d+//g" | stats c by new_field

/k

cpeteman
Contributor

Well this helped me find a solution even though it ended up being a macro.

0 Karma

cpeteman
Contributor

I would prefer to be able to do it as a default field whereas if I went this way it'd probably end up as a macro, but it's given me some ideas. I'll get back to you. Thanks.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...