topic Re: show only fields values with alphanumeric value in Splunk Search

show only fields values with alphanumeric value

SathyaNarayanan — Thu, 03 Aug 2017 09:34:09 GMT

Hi,

I have a field suser in my table, in that i have many values like Password Manager, Batcch , s4545 , Wb 5245 like tat, but i need to show only value come like s4545 or wb5245 or 4693 (alphanumeric value in a filed value)

Thanks in Advance.

Re: show only fields values with alphanumeric value

FritzWittwer_ol — Thu, 03 Aug 2017 10:13:07 GMT

Use a rex function to get the values out of the field you need, see Splunk Search Reference

Re: show only fields values with alphanumeric value

gcusello — Thu, 03 Aug 2017 10:52:18 GMT

Hi SathyaNarayanan,
the only way is to filter events using a regex like the following

| rex field=suser ")?<suser_filtered>\w+)"

| rex field=suser ")?<suser_filtered>[^ \\\|\!\"\£\$\%\&\/\(\)\=\?\^\'\*\+\,\.\;\:\-\_]+)"

Bye.
Giuseppe