Splunk Search

Extracting an alphanumeric expression from a line

shilpi
New Member

I have a logger like below and I need to extract the alphanumeric word from this line-

"My employeeID E1233244345 is valid"

The alphanumeric word will always start with E (eg E1233244345) followed by 10 digits.

I need to extract this alphanumeric word from this line.
Please help

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

You can do it from the search query with rex like so;

your base search | rex "My\semployeeID\s(?<EmpID>\w+)\sis\svalid\." | ...

This is a fairly explicit statement, and in order to extract the employeeID (as EmpID), it has to be inside the sentence as specified above. However, the capture specification as such is only defined as 'more than one character'.

An alternative - if the employeeID turns up in other sentences - is to make the specification stricter, and the anchoring looser. I.e. it could follow either a space or a colon, must start with a capital E, followed by 10 digits exactly, then space.

your base search | rex "[:\s](?<EmpID>E\d{10})\s" 

Hope this helps,

/K

shilpi
New Member

Thanks for this answer..It worked:)

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...