https://community.splunk.com/t5/Splunk-Search/How-to-check-field-values-are-valid/m-p/303361#M91274 <P>hey @chitreshkumar</P> <P>try this run anywhere search</P> <PRE><CODE>| makeresults | eval sequence="EH12839911" | append [| makeresults | eval sequence="EH12831421"] | append [| makeresults | eval sequence="3512839911"] |eval status=if(match(sequence,"^[A-Za-z]{2}[0-9]{8}"),"Valid","Invalid") </CODE></PRE> <P>Ideally in your environment you should write</P> <PRE><CODE>&lt;your_base_search&gt; | eval status=if(match(sequence,"^[A-Za-z]{2}[0-9]{8}"),"Valid","Invalid") </CODE></PRE> <P>Let me know if this works!</P> Fri, 12 Jan 2018 07:09:33 GMT mayurr98 2018-01-12T07:09:33Z https://community.splunk.com/t5/Splunk-Search/How-to-check-field-values-are-valid/m-p/303360#M91273 <P>I have field which is having sequence number .I want to check if it is valid and make a new field that will give if sequence number field is valid/invalid . Format is like "EH12839911" 10 digits first two letters alphabet while next 8 are digits.</P> Fri, 12 Jan 2018 06:38:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-field-values-are-valid/m-p/303360#M91273 chitreshakumar 2018-01-12T06:38:04Z https://community.splunk.com/t5/Splunk-Search/How-to-check-field-values-are-valid/m-p/303361#M91274 <P>hey @chitreshkumar</P> <P>try this run anywhere search</P> <PRE><CODE>| makeresults | eval sequence="EH12839911" | append [| makeresults | eval sequence="EH12831421"] | append [| makeresults | eval sequence="3512839911"] |eval status=if(match(sequence,"^[A-Za-z]{2}[0-9]{8}"),"Valid","Invalid") </CODE></PRE> <P>Ideally in your environment you should write</P> <PRE><CODE>&lt;your_base_search&gt; | eval status=if(match(sequence,"^[A-Za-z]{2}[0-9]{8}"),"Valid","Invalid") </CODE></PRE> <P>Let me know if this works!</P> Fri, 12 Jan 2018 07:09:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-field-values-are-valid/m-p/303361#M91274 mayurr98 2018-01-12T07:09:33Z