Dashboards & Visualizations

How to check digit in search?

Digvijay
Path Finder

My search query -

source="http:product_inv_rest" | spath message | search message="Request: GET */product-inventory/product 123456"

In above query , I want to find records which has any number (only number) in place of 123456.

 

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the regex command will do.

source="http:product_inv_rest" 
| spath message 
| search message="Request: GET */product-inventory/product *"
| regex message="\s\d+$"
---
If this reply helps you, Karma would be appreciated.

Digvijay
Path Finder

Hi @richgalloway ,

 

Thanks for response . One more help needed to search following :

source="http:product_inv_rest" | spath message | search message="Response: GET */product-inventory/product 123456 responseBody=*"

search having any digit instead of 123456

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The answer is similar to the last one.

source="http:product_inv_rest" 
| spath message 
| search message="Response: GET */product-inventory/product * responseBody=*"
| regex message="\s\d+ responseBody=.*$"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Digvijay
Path Finder

@richgalloway ,

Thanks for reply ,but unfortunately its not giving me any record .

0 Karma

efavreau
Motivator

@Digvijay 
It's a matter of customizing the regular expression as you need. There's a lot of pros and cons to using regular expressions, so make sure all your use cases and negative use cases work with your query. Try this:

 

source="http:product_inv_rest"
| spath message
| regex message="\/product\s(?!123456)(?<TheseAreTheNumbersIWant>\d+)"
| search TheseAreTheNumbersIWant=*

 

Now all the results following this line will have a number in the message and that number isn't 123456.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...