topic Re: Regex checking with strings and numbers in Reporting

Regex checking with strings and numbers

andres91302 — Sat, 29 May 2021 14:59:46 GMT

Hello to you all guys

I am new to splunk regex I have been kind of bumping my head trying to do the following:
I need to validate if the value of a field is mad eup of only numbers... then I have to check that the length of this numbers is only equal to 4 and that this number starts with 0 kind of something like this:

client hospital bed	only_numbers?	4_digits?	starts_with_0?
0458	YES	YES	YES
0845A8	NO	NO	NO

The above result is the one that I want that I am looking for because if the vlue is not made out of numbers then.. I want the other two checks to be "NO"

index="host_pnts_beds_ocup_ward_12_13" | search beds_ocu=* AND ward IN ("12","12A","13B") | rename beds_ocu as client_hospital_bed | table client_hospital_bed

thank you so much guys for your help! you people rock

Re: Regex checking with strings and numbers

gcusello — Sat, 29 May 2021 15:14:37 GMT

Hi @andres91302,

you should try to use the eval command with match function, something like this:

obviously applied to your real case.

Ciao.

Giuseppe

Re: Regex checking with strings and numbers

kamlesh_vaghela — Sat, 29 May 2021 15:20:28 GMT

@andres91302

Can you please try this?

YOUR_SEARCH | eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No") | table client_hospital_bed only_numbers 4_digits starts_with_0

My Sample Search :

| makeresults | eval client_hospital_bed="0458|0845A8", client_hospital_bed=split(client_hospital_bed,"|") | mvexpand client_hospital_bed |rename comment as "Upto Now is sample data only" | eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No") | table client_hospital_bed only_numbers 4_digits starts_with_0

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.