Dashboards & Visualizations

How to check digit in search?

Digvijay
Path Finder

My search query -

source="http:product_inv_rest" | spath message | search message="Request: GET */product-inventory/product 123456"

In above query , I want to find records which has any number (only number) in place of 123456.

 

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the regex command will do.

source="http:product_inv_rest" 
| spath message 
| search message="Request: GET */product-inventory/product *"
| regex message="\s\d+$"
---
If this reply helps you, Karma would be appreciated.

Digvijay
Path Finder

Hi @richgalloway ,

 

Thanks for response . One more help needed to search following :

source="http:product_inv_rest" | spath message | search message="Response: GET */product-inventory/product 123456 responseBody=*"

search having any digit instead of 123456

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The answer is similar to the last one.

source="http:product_inv_rest" 
| spath message 
| search message="Response: GET */product-inventory/product * responseBody=*"
| regex message="\s\d+ responseBody=.*$"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Digvijay
Path Finder

@richgalloway ,

Thanks for reply ,but unfortunately its not giving me any record .

0 Karma

efavreau
Motivator

@Digvijay 
It's a matter of customizing the regular expression as you need. There's a lot of pros and cons to using regular expressions, so make sure all your use cases and negative use cases work with your query. Try this:

 

source="http:product_inv_rest"
| spath message
| regex message="\/product\s(?!123456)(?<TheseAreTheNumbersIWant>\d+)"
| search TheseAreTheNumbersIWant=*

 

Now all the results following this line will have a number in the message and that number isn't 123456.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...