topic Only show logs where field value has a decimal place in Splunk Search

Only show logs where field value has a decimal place

bcarr12 — Tue, 17 Oct 2017 16:24:17 GMT

Hi all,

I'm trying to run a search that only finds specific events in a log which have field X equal to a number with a decimal place. Creating the search of simply X>0 returns all log events with any number, which is a good start. Now I'm just looking to filter the results a bit more so only logs having field X equal to any number that has a decimal place will be displayed. What would be the best way to accomplish this?

Thanks.

Re: Only show logs where field value has a decimal place

DalJeanis — Tue, 17 Oct 2017 16:32:19 GMT

This searches for a period anywhere in field myfield, and drops all records that do not have one.

| regex myfield="\."

Re: Only show logs where field value has a decimal place

bcarr12 — Tue, 17 Oct 2017 17:04:48 GMT

This is exactly what I needed. Thank you!