Splunk Search

Extracting an alphanumeric expression from a line

shilpi
New Member

I have a logger like below and I need to extract the alphanumeric word from this line-

"My employeeID E1233244345 is valid"

The alphanumeric word will always start with E (eg E1233244345) followed by 10 digits.

I need to extract this alphanumeric word from this line.
Please help

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

You can do it from the search query with rex like so;

your base search | rex "My\semployeeID\s(?<EmpID>\w+)\sis\svalid\." | ...

This is a fairly explicit statement, and in order to extract the employeeID (as EmpID), it has to be inside the sentence as specified above. However, the capture specification as such is only defined as 'more than one character'.

An alternative - if the employeeID turns up in other sentences - is to make the specification stricter, and the anchoring looser. I.e. it could follow either a space or a colon, must start with a capital E, followed by 10 digits exactly, then space.

your base search | rex "[:\s](?<EmpID>E\d{10})\s" 

Hope this helps,

/K

shilpi
New Member

Thanks for this answer..It worked:)

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...