Splunk Search

Extract only few characters from string

kavyatim
Path Finder

hi i want to extract only 2,3,4,6 position characters from the below set 1DA222
1DA222
1DA222
1DA121
1DA122
1DA222
1DA222
1DA222
Expected output will be DA22,DA11 so on. .

Can any one help me out in writing regex for this.

Thanking you in advance.

Tags (1)

thesteve
Path Finder

Not sure where you are using this, but in general:

^.(.{3}).(.)

The ^ character matches the start of a string.

. will match any character, we don't care about the first character, so we're leaving that out of the grouping.

(.{3}) will match any character 3 times. Surrounding it by parenthesis makes it a grouped match.

. will match any character again, this time we're matching the fifth character and leaving it out of the grouping

(.) the last part of the regex grabs the next character, which is the 6th position and adds it to a grouping.

At this point you have a regex that will pull characters at positions 2,3,4, and 6. Those characters are in 2 match groupings. The first grouping contains characters 2,3, and 4. The second grouping contains character 6.

Unfortunately I don't know of a way to phrase a single regex expression that will strip a character from the middle of a string.

Alternatively, you could replace the '.' characters with '\S' to match non-whitespace.

Also generally, a regex substitution can be used, such as

s/^.(.{3}).(.)/\1\2/

s/match/replace/ The match hasn't changed from above, but the \1\2 in the replace part means take any matched text and replace it with Group1Group2, where Group1 is characters at position 2,3,4 and Group2 is the character at position 6. Depending on where you want to use the regular expression, substitution might or might not be possible.

Note: I haven't tested the above regular expressions, so my syntax might be a little off.

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

Please try the following:

rex field=yourfield mode=sed "s/\w(\w{3})\w(\w)/\1\2/g"

thesteve
Path Finder

That's right. I was thinking of \b. Sorry, regular expressions strain my brain sometimes.

0 Karma

bchoi_splunk
Splunk Employee
Splunk Employee

\w is "A single word character - alphanumeric and underscore."

thesteve
Path Finder

Isn't "\w" a word boundary? I thought maybe you meant "\S" for non-whitespace.

0 Karma

kavyatim
Path Finder

Thank you very much for regex . .it worked

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...