https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412901#M119003 <P>Does this work? <CODE>regex "(EXT_CODE\d{1,3}=|GEN_CODE\d{1,3}=)</CODE></P> Mon, 20 Aug 2018 15:46:12 GMT tomawest 2018-08-20T15:46:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412895#M118997 <P>Below are my 3 logs, i want to write a query, to get all the below 3 logs:</P> <PRE><CODE>**EXT_CODE*[0-9]** with 1/2/3 digit followed by EXT_CODE index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010 index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016 index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010 </CODE></PRE> <P>Can some one please suggest the query</P> <PRE><CODE>my query: index="zync*" EXT_CODE[0-9]*="*" </CODE></PRE> Mon, 20 Aug 2018 10:41:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412895#M118997 arjun_krishna 2018-08-20T10:41:37Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412896#M118998 <P>can you please share some sample logs and what you need to extract..</P> Mon, 20 Aug 2018 11:38:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412896#M118998 493669 2018-08-20T11:38:10Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412897#M118999 <P>log1: index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010<BR /> log2: index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016<BR /> log3: index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010</P> <P>from multiple logs, i have to get above logs which are having EXT_CODE followed by 1/2/3 digit followed (Eg: EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)</P> Tue, 29 Sep 2020 20:57:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412897#M118999 arjun_krishna 2020-09-29T20:57:25Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412898#M119000 <P>provided that that is the _raw, if you just need to find the events you can use the regex command:</P> <P>| makeresults<BR /><BR /> | eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010" <BR /> | regex "(EXT|GEN)_CODE\d{1,3}="</P> Tue, 29 Sep 2020 20:57:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412898#M119000 mhoogcarspel_sp 2020-09-29T20:57:28Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412899#M119001 <P>regex "EXT_CODE\d{1,3}="<BR /> This is working for me , but i want both <STRONG>EXT_CODE</STRONG> &amp; <STRONG>GEN_CODE</STRONG> followed by 1/2/3 digit followed (Eg: GEN_CODE017 (or) GEN_CODE001 (or) GEN_CODE999 (or) EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......) </P> Tue, 29 Sep 2020 20:57:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412899#M119001 arjun_krishna 2020-09-29T20:57:30Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412900#M119002 <P>@mhoogcarspel , Please respond</P> Mon, 20 Aug 2018 14:07:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412900#M119002 arjun_krishna 2018-08-20T14:07:39Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412901#M119003 <P>Does this work? <CODE>regex "(EXT_CODE\d{1,3}=|GEN_CODE\d{1,3}=)</CODE></P> Mon, 20 Aug 2018 15:46:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412901#M119003 tomawest 2018-08-20T15:46:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412902#M119004 <P>Missed that part </P> <P>(EXT|GEN)_CODE\d{1,3}=</P> <P>should work for that</P> <P>btw, I use regex101 for a lot of these things:<BR /> <A href="https://regex101.com/r/RfKqEt/2">https://regex101.com/r/RfKqEt/2</A><BR /> really great tool</P> Mon, 20 Aug 2018 15:47:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412902#M119004 mhoogcarspel_sp 2018-08-20T15:47:37Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412903#M119005 <P>Great its working for me</P> Tue, 21 Aug 2018 09:55:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regex-for-string-followed-by-number/m-p/412903#M119005 arjun_krishna 2018-08-21T09:55:34Z