Other Usage

RegEx Help - how to extract the numbers from string?

madhav_dholakia
Contributor

Hi,

For given sample data set, how can I extract all the numbers (will be always 3 digits) from desc?

 

 

 

| makeresults
| eval desc="Frankfurt (123) & Saarbrucken (456), Germany - Primary down / Secondary down"
| append
[| makeresults 
| eval desc="Frankfurt (123), Saarbrucken (456), Frankfurt Zeil (789) & Kaiserslautern (012), Germany - Primary up / Secondary up"]
| append
[| makeresults 
| eval desc="Test - Creteil - (123) - France - Primary Up // Secondary Up"]
| append
[| makeresults 
| eval desc="All devices at 456 London, England are alerting as down and unreachable"]
| append
[| makeresults 
| eval desc="Test - 123-Clonmel ( Ireland) - Primary DOWN / Secondary UP/ Switch UP"]

 

 

 

 

output required:

madhav_dholakia_0-1687328137734.png

 

can you please suggest regex I can use for the same?

Thank you.

Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@madhav_dholakia 

Can you please try the below search?

YOUR_SEARCH
    | rex field=desc "(?<loc>\d+)" max_match=0
    | eval loc = mvjoin(loc,",")

 

My Sample Search :

| makeresults 
| eval desc="Frankfurt (123) & Saarbrucken (456), Germany - Primary down / Secondary down" 
| append 
    [| makeresults 
    | eval desc="Frankfurt (123), Saarbrucken (456), Frankfurt Zeil (789) & Kaiserslautern (012), Germany - Primary up / Secondary up"] 
| append 
    [| makeresults 
    | eval desc="Test - Creteil - (123) - France - Primary Up // Secondary Up"] 
| append 
    [| makeresults 
    | eval desc="All devices at 456 London, England are alerting as down and unreachable"] 
| append 
    [| makeresults 
    | eval desc="Test - 123-Clonmel ( Ireland) - Primary DOWN / Secondary UP/ Switch UP"]
    | rex field=desc "(?<loc>\d+)" max_match=0
    | eval loc = mvjoin(loc,",")
|table loc

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

View solution in original post

madhav_dholakia
Contributor

thanks @kamlesh_vaghela and @ITWhisperer for prompt response. worked like a charm.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval desc="Frankfurt (123) & Saarbrucken (456), Germany - Primary down / Secondary down"
| append
[| makeresults 
| eval desc="Frankfurt (123), Saarbrucken (456), Frankfurt Zeil (789) & Kaiserslautern (012), Germany - Primary up / Secondary up"]
| append
[| makeresults 
| eval desc="Test - Creteil - (123) - France - Primary Up // Secondary Up"]
| append
[| makeresults 
| eval desc="All devices at 456 London, England are alerting as down and unreachable"]
| append
[| makeresults 
| eval desc="Test - 123-Clonmel ( Ireland) - Primary DOWN / Secondary UP/ Switch UP"]
| rex max_match=0 field=desc "(?<loc>\d{3})"
| eval loc=mvjoin(loc,",")

kamlesh_vaghela
SplunkTrust
SplunkTrust

@madhav_dholakia 

Can you please try the below search?

YOUR_SEARCH
    | rex field=desc "(?<loc>\d+)" max_match=0
    | eval loc = mvjoin(loc,",")

 

My Sample Search :

| makeresults 
| eval desc="Frankfurt (123) & Saarbrucken (456), Germany - Primary down / Secondary down" 
| append 
    [| makeresults 
    | eval desc="Frankfurt (123), Saarbrucken (456), Frankfurt Zeil (789) & Kaiserslautern (012), Germany - Primary up / Secondary up"] 
| append 
    [| makeresults 
    | eval desc="Test - Creteil - (123) - France - Primary Up // Secondary Up"] 
| append 
    [| makeresults 
    | eval desc="All devices at 456 London, England are alerting as down and unreachable"] 
| append 
    [| makeresults 
    | eval desc="Test - 123-Clonmel ( Ireland) - Primary DOWN / Secondary UP/ Switch UP"]
    | rex field=desc "(?<loc>\d+)" max_match=0
    | eval loc = mvjoin(loc,",")
|table loc

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...