https://community.splunk.com/t5/Knowledge-Management/Eventtype-Definition-Search-by-Field-Value-length/m-p/18008#M132 <P>As in <A href="http://answers.splunk.com/questions/10145/case-sensitivity-in-eventtype-searches/10197#10197" rel="nofollow">http://answers.splunk.com/questions/10145/case-sensitivity-in-eventtype-searches/10197#10197</A>, you should be able to coerce your regex to extract fields that are only of a certain length.</P> Thu, 30 Dec 2010 01:06:33 GMT Stephen_Sorkin 2010-12-30T01:06:33Z https://community.splunk.com/t5/Knowledge-Management/Eventtype-Definition-Search-by-Field-Value-length/m-p/18007#M131 <P>Similarly, I want to make a group/eventtype of events from a certain sourcetype where the LOGINID values are all 12 characters long. I can get these events out using pipes and regexes, but then eventtypes does not accept search queries with pipes. Is there a way to extract the LOGINID length as a seperate field that I can use to search on in my eventtype query? </P> Mon, 27 Dec 2010 13:32:26 GMT https://community.splunk.com/t5/Knowledge-Management/Eventtype-Definition-Search-by-Field-Value-length/m-p/18007#M131 gpburgett 2010-12-27T13:32:26Z https://community.splunk.com/t5/Knowledge-Management/Eventtype-Definition-Search-by-Field-Value-length/m-p/18008#M132 <P>As in <A href="http://answers.splunk.com/questions/10145/case-sensitivity-in-eventtype-searches/10197#10197" rel="nofollow">http://answers.splunk.com/questions/10145/case-sensitivity-in-eventtype-searches/10197#10197</A>, you should be able to coerce your regex to extract fields that are only of a certain length.</P> Thu, 30 Dec 2010 01:06:33 GMT https://community.splunk.com/t5/Knowledge-Management/Eventtype-Definition-Search-by-Field-Value-length/m-p/18008#M132 Stephen_Sorkin 2010-12-30T01:06:33Z