https://community.splunk.com/t5/Getting-Data-In/Filter-an-event-where-first-2-characters-are-in-uppercase/m-p/567113#M100761 <P>Thanks! This has worked a treat</P> Wed, 15 Sep 2021 12:42:36 GMT vishalduttauk 2021-09-15T12:42:36Z https://community.splunk.com/t5/Getting-Data-In/Filter-an-event-where-first-2-characters-are-in-uppercase/m-p/566974#M100745 <P>I am ingesting a text file and I have created a field called Flag. I am looking to create a filter which only shows me events where the first two characters of that field are in capitals.</P><P>&nbsp;</P><P>I.e. I want to see event where Flag is VMs, SVictor, ARev but not Amy, Fox or Dana.</P><P>&nbsp;</P><P>Can you help?</P> Tue, 14 Sep 2021 13:35:58 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-an-event-where-first-2-characters-are-in-uppercase/m-p/566974#M100745 vishalduttauk 2021-09-14T13:35:58Z https://community.splunk.com/t5/Getting-Data-In/Filter-an-event-where-first-2-characters-are-in-uppercase/m-p/566978#M100746 <P>Try the <FONT face="courier new,courier">regex</FONT> command.</P><LI-CODE lang="markup">index = foo | regex Flag="^[A-Z]{2}"</LI-CODE> Tue, 14 Sep 2021 13:57:51 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-an-event-where-first-2-characters-are-in-uppercase/m-p/566978#M100746 richgalloway 2021-09-14T13:57:51Z https://community.splunk.com/t5/Getting-Data-In/Filter-an-event-where-first-2-characters-are-in-uppercase/m-p/567113#M100761 <P>Thanks! This has worked a treat</P> Wed, 15 Sep 2021 12:42:36 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-an-event-where-first-2-characters-are-in-uppercase/m-p/567113#M100761 vishalduttauk 2021-09-15T12:42:36Z