Splunk Search

Extract characters without digit

royimad
Builder

I have a field in the log like the following:
abc1232
ab.sadkjsakj21302139
abc3400349
alex.carl2103920

I need to extract all characters without the digital number. How to do that using regular expression? rex or interactive field extraction?

Thanks

Tags (3)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

If you are going to be using it repeatedly, I would place it in a props/transforms. But you can do it via search line.

|rex field=myfield "(?<no_digits>[^\d]*)"

OR with props.conf

[mysourcetype]
EXTRACT-myfield = (?<no_digits>[^\d]*) in myfield

gfuente
Motivator

Hello

You could use this regular expresion:

(?<mystring>\D+)

And using the rex command:

... | rex "(?< mystring >\D+)" | ...

*Without the spaces before and after the field name

Regards

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...