topic Re: regex help text and numeric value in Splunk Search

regex help text and numeric value

dbashyam — Mon, 28 Sep 2020 17:44:50 GMT

Hi, I have a following text coming in splunk

abcd, 2000-01-10 10:40:43, P:welcome, welcome_to_all, 0, 2000-01-10 16:09:04
abcd, 2000-01-10 10:40:45, P:welcome, welcome_to_all, 1, 2000-01-10 16:10:04

I want to write a search which will get me only having text "welcome_to_all" and the next field should be greater than or equal to 1.

I am able to write the regex but regex _raw="(welcome_to_all,\d{0})" but not sure how to get the greater than 1. The regex which I wrote is pulling all 0 but I need which are greater than 0.

Thanks,

Re: regex help text and numeric value

markthompson — Tue, 30 Sep 2014 12:09:41 GMT

Please explain in more depth, as I'm not totally sure what the equal to 1 or greater than 1 means?

I think the solution could be a simple search with an IF statement? Just an idea, if you put some more depth in, with what you want, and an example, I'll be able to help.

Re: regex help text and numeric value

richgalloway — Tue, 30 Sep 2014 12:28:44 GMT

I think you were close. Try

rex "welcome_to_all,\s[^0]"

Re: regex help text and numeric value

dbashyam — Mon, 28 Sep 2020 17:45:39 GMT

Hi, thanks for your responses. Let me elaborate. The values that comes after the string "welcome_to_all" is a string and what "richgalloway" said is correct it helps me resolve my issue, but I have another question,

How do I find if its greater than 100, I want to get the strings which are having greater than 100 or more?

With the current rex "welcome_to_all,\s[100]" I will be getting only value 100 but if I want to get values like '0', and above 100 what should I do?

abcd, 2000-01-10 10:40:43, P:welcome, welcome_to_all, 0, 2000-01-10 16:09:04
abcd, 2000-01-10 10:40:45, P:welcome, welcome_to_all, 1, 2000-01-10 16:10:04

Thanks for your help

Re: regex help text and numeric value

markthompson — Wed, 01 Oct 2014 07:53:12 GMT

I think you can use welcome_to_all,s[0,100+] not totally sure if this is true, you might also be able to use >100 in your rex statement.

Re: regex help text and numeric value

MuS — Wed, 01 Oct 2014 08:08:02 GMT

Hi dbashyam,

try something like this:

rex "all,\s[0],{1}|all,\s1\d{2},"

this will match 0 or 100-199

cheers, MuS