topic Re: Rex 16 digit account number that always starts with 8 in Splunk Search

Rex 16 digit account number that always starts with 8

kmccowen — Mon, 22 Jun 2015 18:35:31 GMT

I using the below REX but i'm getting unwanted values for another field that is not related to account number.

REX: -\s(?<acct>\d{16})

Example Log:

[2015-06-21T23:59:53.882-05:00] [gw_server6] [NOTIFICATION] [] [com.charter.customer.care.view.backing.banner.BannerFlowBean] [tid: [ACTIVE].ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: cbrewster] [ecid: 8e4ec398-841d-45ad-9eb6-dec27a6d5b42-0004b72b,0] [APP: chtrgwy] 2015-06-21 23:59:53.882 - CTIPOP CALL RECEIVED - FGS - 8246100013000800- 8178750270 - 558795aa00000000ac10edf823300002

My extraction is pulling in a value of 5586441100000000 in some cases but in most cases i'm getting what I want which would be 8246100013000800

Valid account numbers should always start with the number "8" is there a way to add that logic into my existing Extraction for my Account number field?

Re: Rex 16 digit account number that always starts with 8

MuS — Tue, 23 Jun 2015 00:07:30 GMT

Hi kmccowen,

try something like this:

your base search here | rex field=_raw "-\s(?<acct>\d{16})\s-" | table acct

This will capture only 16 digits until the next - is found.

Hope this helps...

cheers, MuS

Re: Rex 16 digit account number that always starts with 8

kmccowen — Tue, 23 Jun 2015 17:44:18 GMT

I just needed to add one blank white space prior to the last "dash" and this fixed the extraction!
Thanks MuS!

Re: Rex 16 digit account number that always starts with 8

kmccowen — Tue, 23 Jun 2015 17:46:42 GMT

Final regex:

your base search here  | rex field=_raw "-\s(?<acct>\d{16})\s-"

Re: Rex 16 digit account number that always starts with 8

kmccowen — Tue, 23 Jun 2015 19:48:02 GMT

need to add a white space "/s" prior to the final dash

Re: Rex 16 digit account number that always starts with 8

MuS — Tue, 23 Jun 2015 19:52:33 GMT

thanks for the hint 😉