I have a userID with 9 characters and want to search a lookup with just 7 characters. I have tried to use RegEx but it just searches that many characters instead of assigning it to the field. Any ideas?
you can do this using rex
as well
Try this run anywhere search
| makeresults
| eval userID="dlcrooks mayurjadhav splunkninja dlcrook123 dl123crooks"
| makemv userID
| mvexpand userID
| rex field=userID "(?<userID>\w{7})"
In your environment, you should write
index=<your_index>
| rex field=userID "(?<userID>\w{7})"
let me know if this helps!
Try:
<base search>|eval userID =substr(userID,1,7)
Hope this helps!
Thanks! It works!
@dlcrooks, please accept answer so that it will no longer open