Filter an event where first 2 characters are in uppercase

[vishalduttauk]

I am ingesting a text file and I have created a field called Flag. I am looking to create a filter which only shows me events where the first two characters of that field are in capitals.

I.e. I want to see event where Flag is VMs, SVictor, ARev but not Amy, Fox or Dana.

Can you help?

[richgalloway · Accepted solution]

Try the regex command.

index = foo
| regex Flag="^[A-Z]{2}"

[vishalduttauk]

Thanks! This has worked a treat