Tobitor
Reputation: 1508
Splunk: Split extracted field after specific position
I extracted a filed which contains phone numbers. The extracted field is named phoneNumbers. I now want to split this field after the fourth number to get the area code.
How could I do this?
Thanks a lot!
Upvotes: 0
Views: 1073
Answers (1)
RichG
Reputation: 9916
Use the substr function.
... | eval areaCode = substr(phoneNumbers, 1, 3)
Upvotes: 1
Related Questions
- splunk query to extract multiple fields from single field
- How to extract data using multiple delimited values in splunk
- Splunk extract a value from string which begins with a particular value
- Splunk field extractions from different events & delimiters
- Splunk: How to extract field directly in Search command using regular expressions?
- Splunk - regex extract fields from source
- Using Splunk rex command to extract a field between 2 words
- How to extract data from the String in splunk?
- Extracting certain fields from Splunk query results
- Splunk: Extracting multiple fields with the same name