topic how to search a number which is 13 digits or more using regex in splunk? in Splunk Search

how to search a number which is 13 digits or more using regex in splunk?

pavanae — Thu, 10 Sep 2015 15:13:25 GMT

Hi how can i find out a number which is 13 digits or more in a splunk search on index="xyz". Please let me know

Re: how to search a number which is 13 digits or more using regex in splunk?

aljohnson_splun — Thu, 10 Sep 2015 15:29:50 GMT

index=foo sourcetype=bar | rex "(?<long_number>\d{13,})"

Re: how to search a number which is 13 digits or more using regex in splunk?

woodcock — Thu, 10 Sep 2015 15:30:22 GMT

Like this:

index=xyz | regex _raw = "\d{13,}"

Re: how to search a number which is 13 digits or more using regex in splunk?

landen99 — Thu, 10 Sep 2015 15:40:08 GMT

double post: https://answers.splunk.com/answers/305693/regex-to-find-out-13-or-more-continuous-numbers-in.html

Re: how to search a number which is 13 digits or more using regex in splunk?

landen99 — Thu, 10 Sep 2015 15:44:02 GMT

You might add max_match=0 to the rex command

Re: how to search a number which is 13 digits or more using regex in splunk?

aljohnson_splun — Thu, 10 Sep 2015 15:49:47 GMT

@Landen998 Why

Re: how to search a number which is 13 digits or more using regex in splunk?

landen99 — Thu, 10 Sep 2015 17:10:13 GMT

The event may have more than one series of 13 digit numbers. The 13 digit number of interest may not be the first one it finds in the event. The event may not have separated correctly. Any other reason.

Re: how to search a number which is 13 digits or more using regex in splunk?

pavanae — Thu, 10 Sep 2015 19:09:09 GMT

So what could be the final search query to display those digits?

Re: how to search a number which is 13 digits or more using regex in splunk?

landen99 — Thu, 10 Sep 2015 19:38:41 GMT

Either

index=foo sourcetype=bar | rex max_match=0 "(?<long_number>\d{13,})"

index=xyz | regex _raw = "\d{13,}"

from Woodcock's answer below. All depends on what you want to do. Extract the number (above) or filter events for the number but not extract it (below). .. or you could do both:

index=foo sourcetype=bar | rex max_match=0 "(?<long_number>\d{13,})" | search long_number=*

Re: how to search a number which is 13 digits or more using regex in splunk?

pavanae — Wed, 23 Sep 2015 19:25:51 GMT

Thanks it worked