Hi ,
I have a table called "Database" with column like this :
COD_SC_CSO
51681
11680
11680
11268
11251
I would like to filter rows only where COD_SC_CSO 2 and 3 position is 68. .
For example if COD_SC_CSO =51681(2 and 3 position is 68), i want to filter entire row of COD_SC_CSO =51681
Can any one help me out to do this.
Thanking
Well, you almost got the answer yourself, you just need to reorder your search a bit.
source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | search str=68 | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla
You are not entirely clear by "filter" if you mean to "keep" or to "throw away" the items with the substring of '68'.
Don't forget, the where
command can do almost anything eval
can do, but can do comparisons as well. So this should work as well:
source="base_bds_adsl.csv" | where (substr(COD_SC_CSO,3,2)=68)
Well, you almost got the answer yourself, you just need to reorder your search a bit.
source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | search str=68 | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla
I'm not sure which is more efficient, but since my brain works in regex, this would also work:
source="base_bds_adsl.csv" | regex COD_SC_CSO="^\d{2}68\d$" | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla
Its a splunk search question:
For time being my query is as follows:
source="base_bds_adsl.csv" | eval str=substr(COD_SC_CSO,3,2) | table str,N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla| where str="68
but i dont want to display str in my table
Is this a splunk search question? Or are you asking how to only index the filtered data ?