topic Re: How to generate a search that will only display results where a field contains some non-alphanumeric characters? in Splunk Search

How to generate a search that will only display results where a field contains some non-alphanumeric characters?

drinkingjimmy — Thu, 23 Mar 2017 20:52:02 GMT

A field is named product. I want to produce a list of products in my source, which are not made up of only english alphanumeric characters (any length).
I.e. Products:
Dog Collar
18 inch Dog Collar
20-inch Dog Collar
Ƨhock collar

would yield only:
20-inch Dog Collar
Ƨhock collar

(Because of the latin character and the hyphen.)

I've seen plenty of uses of sed to remove/replace the non-alphanumerics, but I don't want to remove, just get a list of the outliers.

Re: How to generate a search that will only display results where a field contains some non-alphanumeric characters?

somesoni2 — Thu, 23 Mar 2017 21:27:10 GMT

Try like this. First two lines are to generate sample data. You need to replace that with your search.

| gentimes start=-1 | eval Product="Dog Collar#18 inch Dog Collar#20-inch Dog Collar#Ƨhock collar" | table Product | makemv Product delim="#" | mvexpand Product 
| regex Product!="^[A-z\s0-9]+$"

This will keep events which have Product with any non-alphanumeric character.