Splunk Search

Extract only few characters from string

kavyatim
Path Finder

hi i want to extract only 2,3,4,6 position characters from the below set 1DA222
1DA222
1DA222
1DA121
1DA122
1DA222
1DA222
1DA222
Expected output will be DA22,DA11 so on. .

Can any one help me out in writing regex for this.

Thanking you in advance.

Tags (1)

thesteve
Path Finder

Not sure where you are using this, but in general:

^.(.{3}).(.)

The ^ character matches the start of a string.

. will match any character, we don't care about the first character, so we're leaving that out of the grouping.

(.{3}) will match any character 3 times. Surrounding it by parenthesis makes it a grouped match.

. will match any character again, this time we're matching the fifth character and leaving it out of the grouping

(.) the last part of the regex grabs the next character, which is the 6th position and adds it to a grouping.

At this point you have a regex that will pull characters at positions 2,3,4, and 6. Those characters are in 2 match groupings. The first grouping contains characters 2,3, and 4. The second grouping contains character 6.

Unfortunately I don't know of a way to phrase a single regex expression that will strip a character from the middle of a string.

Alternatively, you could replace the '.' characters with '\S' to match non-whitespace.

Also generally, a regex substitution can be used, such as

s/^.(.{3}).(.)/\1\2/

s/match/replace/ The match hasn't changed from above, but the \1\2 in the replace part means take any matched text and replace it with Group1Group2, where Group1 is characters at position 2,3,4 and Group2 is the character at position 6. Depending on where you want to use the regular expression, substitution might or might not be possible.

Note: I haven't tested the above regular expressions, so my syntax might be a little off.

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

Please try the following:

rex field=yourfield mode=sed "s/\w(\w{3})\w(\w)/\1\2/g"

thesteve
Path Finder

That's right. I was thinking of \b. Sorry, regular expressions strain my brain sometimes.

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

\w is "A single word character - alphanumeric and underscore."

thesteve
Path Finder

Isn't "\w" a word boundary? I thought maybe you meant "\S" for non-whitespace.

0 Karma

kavyatim
Path Finder

Thank you very much for regex . .it worked

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...