Getting Data In

Filter an event where first 2 characters are in uppercase

vishalduttauk
Explorer

I am ingesting a text file and I have created a field called Flag. I am looking to create a filter which only shows me events where the first two characters of that field are in capitals.

 

I.e. I want to see event where Flag is VMs, SVictor, ARev but not Amy, Fox or Dana.

 

Can you help?

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try the regex command.

index = foo
| regex Flag="^[A-Z]{2}"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try the regex command.

index = foo
| regex Flag="^[A-Z]{2}"
---
If this reply helps you, Karma would be appreciated.

vishalduttauk
Explorer

Thanks! This has worked a treat

Tags (1)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...