Reporting

Regex checking with strings and numbers

andres91302
Communicator

Hello to you all guys

 

I am new to splunk regex I have been kind of bumping my head trying to do the following:
I need to validate if the value of a field is mad eup of only numbers... then I have to check that the length of this numbers is only equal to 4 and that this number starts with 0 kind of something like this:

client hospital bedonly_numbers?4_digits?starts_with_0?
0458YESYESYES
0845A8NONONO

 

The above result is the one that I want that I am looking for because if the vlue is not made out of numbers then.. I want the other two checks to be "NO"

 

index="host_pnts_beds_ocup_ward_12_13"
| search beds_ocu=* AND ward IN ("12","12A","13B")
| rename beds_ocu as client_hospital_bed
| table client_hospital_bed

 

 

thank you so much guys for your help! you people rock

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andres91302 

 

Can you please try this?

 

YOUR_SEARCH
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

My Sample Search :

 

| makeresults 
| eval client_hospital_bed="0458|0845A8", client_hospital_bed=split(client_hospital_bed,"|") 
| mvexpand client_hospital_bed
|rename comment as "Upto Now is sample data only"
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andres91302 

 

Can you please try this?

 

YOUR_SEARCH
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

My Sample Search :

 

| makeresults 
| eval client_hospital_bed="0458|0845A8", client_hospital_bed=split(client_hospital_bed,"|") 
| mvexpand client_hospital_bed
|rename comment as "Upto Now is sample data only"
| eval only_numbers=if(isnull(tonumber(client_hospital_bed)),"No","Yes"), 4_digits=if(len(client_hospital_bed)==4,"Yes","No"),starts_with_0=if(substr(client_hospital_bed,0,1)=="0","Yes","No")
| table client_hospital_bed only_numbers 4_digits starts_with_0

 

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

gcusello
SplunkTrust
SplunkTrust

Hi @andres91302,

you should try to use the eval command with match function, something like this:

| makeresults | eval myfield="1234a1"
| append [ | makeresults | eval myfield="12341"]
| eval status=if(match(myfield,"[A-Z a-z]"),"yes","no")

obviously applied to your real case.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...