Hi, I have a following text coming in splunk
abcd, 2000-01-10 10:40:43, P:welcome, welcome_to_all, 0, 2000-01-10 16:09:04
abcd, 2000-01-10 10:40:45, P:welcome, welcome_to_all, 1, 2000-01-10 16:10:04
I want to write a search which will get me only having text "welcome_to_all" and the next field should be greater than or equal to 1.
I am able to write the regex but regex _raw="(welcome_to_all,\d{0})"
but not sure how to get the greater than 1. The regex which I wrote is pulling all 0 but I need which are greater than 0.
Thanks,
I think you can use welcome_to_all,s[0,100+]
not totally sure if this is true, you might also be able to use >100 in your rex statement.
Hi, thanks for your responses. Let me elaborate. The values that comes after the string "welcome_to_all" is a string and what "richgalloway" said is correct it helps me resolve my issue, but I have another question,
With the current rex "welcome_to_all,\s[100]" I will be getting only value 100 but if I want to get values like '0', and above 100 what should I do?
abcd, 2000-01-10 10:40:43, P:welcome, welcome_to_all, 0, 2000-01-10 16:09:04
abcd, 2000-01-10 10:40:45, P:welcome, welcome_to_all, 1, 2000-01-10 16:10:04
Thanks for your help
Hi dbashyam,
try something like this:
rex "all,\s[0],{1}|all,\s1\d{2},"
this will match 0
or 100-199
cheers, MuS
I think you were close. Try
rex "welcome_to_all,\s[^0]"
Please explain in more depth, as I'm not totally sure what the equal to 1 or greater than 1 means?
I think the solution could be a simple search with an IF statement? Just an idea, if you put some more depth in, with what you want, and an example, I'll be able to help.