Splunk Search

New field from search results

nburgess1
Explorer

Hi,

I have a field called "OrgCode" with data like "L6" "L9" "G6" "K6" "K4", which is departments L G and K. I need to get a new field for each department.

Thanks

Tags (1)
0 Karma

nburgess1
Explorer

The substr method returns a new field with the first character of the OrgCode field. What I need is a field for DeptL where only the OrgCodes that start with L are in it. Then a DeptK field with only the OrgCodes that start with K are in it, and so on. This seems logical to me but doesn't work:

 eval DeptA=[search OrgCode=A*]
0 Karma

somesoni2
SplunkTrust
SplunkTrust

After the field Department/dept is created, you will be able to filter records for a single department.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming the department code is always the first character of OrgCode, one of these should do the job.

... | rex field=OrgCode "(?<dept>\w)" | ...

... | eval dept = substr(OrgCode, 1, 1) | ...
---
If this reply helps you, Karma would be appreciated.

somesoni2
SplunkTrust
SplunkTrust

Try this

your current search which include field OrgCode | eval Deparment=replace(OrgCode,"^([A-z]+)\d+","\1")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...