Dashboards & Visualizations

Extract field that contains capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard

archananaveen
Explorer

Hi There,
I need to extract Field3 which can contain capital letters, numbers and characters and pass that output as a list to dropdown in a dashboard. Please could you suggest the splunk expression for doing this? And also, how to remove duplicates in the list?

/Filed1/Field2/Field-3/xxxx/xxxx/xxx

Below regular expression is getting me field 3.
(\/\w+){2}\/(.*?)\/

Regards,

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

If your regex works on your data as you say it does, then this should work:

<search-to-get-your-data> | rex "(/\w+){2}/(?P<field3>.*?)/" | table field3 | dedup field3 | sort field3

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
does the above regex extract the wanted field?
if yes you could use it in search

your_search
| rex field=source "(\/\w+){2}\/(?<Field3>[^\/]*)"
| dedup Field3
| sort Field3
| table Field3

Bye.
Giuseppe

cpetterborg
SplunkTrust
SplunkTrust

If your regex works on your data as you say it does, then this should work:

<search-to-get-your-data> | rex "(/\w+){2}/(?P<field3>.*?)/" | table field3 | dedup field3 | sort field3
0 Karma

archananaveen
Explorer

Thank you. Search is working but taking a long time, is there anyway I could store values for this to a particular field to be used by other lookup's or queries later on?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You can use the outputlookup command:

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1/SearchReference/Outputlookup

There are a multitude of ways that you could use this, so I'm not going to elaborate here on how to do it. If you have specific questions about how you want to use it to store your data, open a new question here in Answers. Go through the doc first so that you can see what you are up against.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...