I'm fairly new to Splunk. I have a field (address). How can I parse just the all numbers from an address line to a new field (so I can list it later in a table) ?
i.e. 123 W Smith St #1
Would become:
1231
Hi
Try this also
| makeresults
| eval address ="123 W Smith St #1"
| rex field=address max_match=0 "(?P<result>[0-9]+)"
| eval result= replace(tostring(result),"\s","")
| table address result
This should do it.
... | eval numbers=address | rex field=numbers mode=sed "s/(\D)//g"
Yeah, many roads lead to this particular Rome. Another one:
... | eval numbers = replace(address, "\D+", "")