Splunk Search

how can i trim until a specific character?

ygdrassil
Engager

Hello,

I got a field that has a format and a value like this "S01-3101" and sometimes a value like this "S01-301"
i just want to get the value of 01 near the letter S and i want to trim the S and "-3101" .

My idea is to trim the value after the "-" and itself, but i dont know if it is possible.

Thank you for your answers!!!!!

Tags (1)
0 Karma

ygdrassil
Engager

Thank you for the answers , i already answer this question by using substrt()

0 Karma

niketn
Legend

@ygdrassil, please go ahead and mention your approach to fix the issue and Accept the same as answer.

In your question you have first mentioned that you are interested in digits after S and then also digits after dot (.)

<YourBaseSearch> yourFieldName=*
| rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)"

If the field value is present on the events you are interested in and you always need this extraction you should check out Field Extraction Knowledge Objects (this way the regular expression based field extraction will persist as Knowledge Object and can be easily maintained and reused.).

Following are some of Splunk Documentation reference for the same: http://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Extractfieldswithsearchcommands
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields
Following is a run anywhere search based on sample data provided:

| makeresults
| eval yourFieldName="S01-3101,S01-301"
| makemv yourFieldName delim="," 
| mvexpand yourFieldName
| rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

493669
Super Champion

try this regex:

   ... |rex field=<fieldname>"^.(?<test>\d+)"

Try this run anywhere search:

|makeresults|eval _raw="S01-3101"|rex field=_raw"^.(?<test>\d+)"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...