Getting Data In

Filter an event where first 2 characters are in uppercase

vishalduttauk
Explorer

I am ingesting a text file and I have created a field called Flag. I am looking to create a filter which only shows me events where the first two characters of that field are in capitals.

 

I.e. I want to see event where Flag is VMs, SVictor, ARev but not Amy, Fox or Dana.

 

Can you help?

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try the regex command.

index = foo
| regex Flag="^[A-Z]{2}"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try the regex command.

index = foo
| regex Flag="^[A-Z]{2}"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

vishalduttauk
Explorer

Thanks! This has worked a treat

Tags (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!