Splunk Enterprise

create a field from regex

omershira
Explorer

Hello,

From my system I recive number of events, some of them contain a value of the letter 'c' and then 7 digits like so: 'c5426987'. I want to create a field by the name user_id that will contain that value.

I tried to use extract field and mark the value I was searching for but it got only some of the results and not all of them, the thing is that the value shows up in different ways like:

- name:c1234567

-somedata/c1234567

- login by c1234567

and I can't find a way to get them all... 

I tested a regex in a website that examines regexes and it did extract what I was searching for. the regex I tested was: "/c[/d]{7}/g" and it gave the wanted results on the website. 

I tried using both rex and regex commands and they didnt seem to work...

can you please help me to find the way to create the field "user_id" using that regex?

thanks!

omer shira

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

your search
| rex "(?<user_id>c\d{7})"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

your search
| rex "(?<user_id>c\d{7})"
---
If this reply helps you, Karma would be appreciated.
0 Karma

omershira
Explorer

Yay! that's worked!

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...