topic Re: Check for only non-numeric value in an extracted field in Splunk Search

Check for only non-numeric value in an extracted field

anirbanukil — Thu, 01 Dec 2011 18:41:48 GMT

I have following string:

2011-12-01T13:31:25-05:0063487210, TEST# 67779806

I have written the following search string:

host="source" source="Out.log" "TEST# "| rex "TEST# (?<test_no>\t+) "

I want to check if "TEST#" contains any non-numeric values (TEST# must contain all numeric field so that the child applications work properly. Child applications can't handle non-numeric value in TEST# field).

How can I check and alert incase there is some non-numeric value in TEST# field.

Please advice.

Re: Check for only non-numeric value in an extracted field

Ayn — Thu, 01 Dec 2011 20:29:02 GMT

I don't get the test_no extraction. It seems to match one or more tabs after TEST#? Typo?

Anyway regarding the question, how to check if a field has numeric content only: either use regex:

... | regex test_no="^\d+$"

Or where with the function isnum:

... | where isnum(test_no)

Re: Check for only non-numeric value in an extracted field

kristian_kolb — Thu, 01 Dec 2011 20:59:10 GMT

Have you looked at eval or where?

There is a function for eval (and where) which is called isnum(X), which may may be what you need.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

hope this helps,

/kristian

Re: Check for only non-numeric value in an extracted field

kristian_kolb — Thu, 01 Dec 2011 21:46:42 GMT

I'll have to learn to finish my answer and hit that "post your answer" button.... 🙂

Re: Check for only non-numeric value in an extracted field

anirbanukil — Thu, 01 Dec 2011 22:38:08 GMT

Thanks a lot for the answer. I was able to solve the issue.

Re: Check for only non-numeric value in an extracted field

dwaddle — Thu, 01 Dec 2011 23:54:57 GMT

That's good. Please use the "accept answer" checkbox next to one of the answers to accept it and mark the question as "answered".