Reporting

Regex checking with strings and numbers

andres91302
Communicator

Hello to you all guys

 

I am new to splunk regex I have been kind of bumping my head trying to do the following:
I need to validate if the value of a field is mad eup of only numbers... then I have to check that the length of this numbers is only equal to 4 and that this number starts with 0 kind of something like this:

client hospital bedonly_numbers?4_digits?starts_with_0?
0458YESYESYES
0845A8NONONO

 

The above result is the one that I want that I am looking for because if the vlue is not made out of numbers then.. I want the other two checks to be "NO"

 

index="host_pnts_beds_ocup_ward_12_13"
| search beds_ocu=* AND ward IN ("12","12A","13B")
| rename beds_ocu as client_hospital_bed
| table client_hospital_bed

 

 

thank you so much guys for your help! you people rock

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andres91302 

 

Can you please try this?

 

YOUR_SEARCH
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

My Sample Search :

 

| makeresults 
| eval client_hospital_bed="0458|0845A8", client_hospital_bed=split(client_hospital_bed,"|") 
| mvexpand client_hospital_bed
|rename comment as "Upto Now is sample data only"
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andres91302 

 

Can you please try this?

 

YOUR_SEARCH
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

My Sample Search :

 

| makeresults 
| eval client_hospital_bed="0458|0845A8", client_hospital_bed=split(client_hospital_bed,"|") 
| mvexpand client_hospital_bed
|rename comment as "Upto Now is sample data only"
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

gcusello
Legend

Hi @andres91302,

you should try to use the eval command with match function, something like this:

| makeresults | eval myfield="1234a1"
| append [ | makeresults | eval myfield="12341"]
| eval status=if(match(myfield,"[A-Z a-z]"),"yes","no")

obviously applied to your real case.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...