Getting Data In

Extracting everything but numbers from _raw message in props.conf

cpeteman
Contributor

I want to extract all characters but digits and have that as a new field. I've done this with easy in search:

|rex mode=sed "/s\d+//g" | rename _raw AS new_field

but this will not let me see the original _raw message nor does props.conf seem to be able to use one field in a new extraction so I cant extract (copy) _raw and the get rid of numbers using SEDCMD. How do I do this? help please???

Tags (2)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

could this be a good thing?

your_base_search | eval new_field = _raw | rex field=new_field mode=sed "s/\d+//g" | stats c by new_field

/k

View solution in original post

kristian_kolb
Ultra Champion

could this be a good thing?

your_base_search | eval new_field = _raw | rex field=new_field mode=sed "s/\d+//g" | stats c by new_field

/k

cpeteman
Contributor

Well this helped me find a solution even though it ended up being a macro.

0 Karma

cpeteman
Contributor

I would prefer to be able to do it as a default field whereas if I went this way it'd probably end up as a macro, but it's given me some ideas. I'll get back to you. Thanks.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...