Splunk Enterprise

How to remove beginning of a fieldname(prefix)?

chenglta
New Member

Generally, I want to transform:
"sort_index"
"89080_10.9.2.0"
"89090_10.9.1.0"
"89150_10.8.5.0"
...

into:
"sort_index"
"10.9.2.0"
"10.9.1.0"
"10.8.5.0"

In all, I want to remove anything before character "_".

I have tried so many rex, wildcard expressions but nothing worked. Like:

| rex field=sort_index “\w{5}_(?<sort_index>\S+)”     (remove 5 characters before _ )
| rename \d+_* as *
| rename \w{5}_* as *

Could anyone please help me to solve this problem?

How does this problem come from? Originally I created a timechart.
92416097-f75f-46ef-884c-f124e557c978.PNG
As illustrated, the version is lexicon-graphically sorted. I want it (field: version ) to be sorted in reverse order.  But | sort -_time, -version simply did not work. So I created a new field named 'sort_index' and sort this new field. In order not to forget 'version', I combine new 'sort_index' with 'version' by adding '_' in the middle.

01_40_43.jpgNow it is in the right order: 10.9.2.0 10.9.1.0 10.8.5.0 10.8.2.0 10.7.3.0 10.5.2.0 
But I need to remove the prefix created previously.
These are the backgrounds why I want to do this work. If you have any better advice to achieve this target, please give me your suggestion.

Best,

Chenglong

0 Karma

thambisetty
Super Champion

did you look into below thread?

https://community.splunk.com/t5/Splunk-Search/Sort-highest-to-lowest-over-time-with-timechart/m-p/34...

————————————
If this helps, give a like below.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval index=split(sort_index,"_")
| eval sort_index=mvindex(index,1)
| fields - index
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>