Splunk Search

How to extract a field based on character count?

eamuncal
Explorer

I have a field name X with the following value: 0123456789.
I want to create another field that is based on the first 4 characters of the field name X.
Then call it Y.

Any idea on how to do this? If its in bash my way would be to use cut -c1-4

Trying the regex and rex to no avail.

Thanks in advance.

emn.

Tags (2)
0 Karma
1 Solution

Ayn
Legend

This should do it:

rex field=X "^(?<Y>\d{4})"

View solution in original post

Ayn
Legend

This should do it:

rex field=X "^(?<Y>\d{4})"

eamuncal
Explorer

This sure did it! Thanks Ayn

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...