Regex checking with strings and numbers

[andres91302]

Hello to you all guys

I am new to splunk regex I have been kind of bumping my head trying to do the following:
I need to validate if the value of a field is mad eup of only numbers... then I have to check that the length of this numbers is only equal to 4 and that this number starts with 0 kind of something like this:

client hospital bed	only_numbers?	4_digits?	starts_with_0?
0458	YES	YES	YES
0845A8	NO	NO	NO

The above result is the one that I want that I am looking for because if the vlue is not made out of numbers then.. I want the other two checks to be "NO"

index="host_pnts_beds_ocup_ward_12_13"
| search beds_ocu=* AND ward IN ("12","12A","13B")
| rename beds_ocu as client_hospital_bed
| table client_hospital_bed

thank you so much guys for your help! you people rock

[kamlesh_vaghela · Accepted solution]

@andres91302 

Can you please try this?

YOUR_SEARCH
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

My Sample Search :

| makeresults 
| eval client_hospital_bed="0458|0845A8", client_hospital_bed=split(client_hospital_bed,"|") 
| mvexpand client_hospital_bed
|rename comment as "Upto Now is sample data only"
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[gcusello]

Hi @andres91302,

you should try to use the eval command with match function, something like this:

| makeresults | eval myfield="1234a1"
| append [ | makeresults | eval myfield="12341"]
| eval status=if(match(myfield,"[A-Z a-z]"),"yes","no")

obviously applied to your real case.

Ciao.

Giuseppe