Splunk Search

Extracting an alphanumeric expression from a line

shilpi
New Member

I have a logger like below and I need to extract the alphanumeric word from this line-

"My employeeID E1233244345 is valid"

The alphanumeric word will always start with E (eg E1233244345) followed by 10 digits.

I need to extract this alphanumeric word from this line.
Please help

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

You can do it from the search query with rex like so;

your base search | rex "My\semployeeID\s(?<EmpID>\w+)\sis\svalid\." | ...

This is a fairly explicit statement, and in order to extract the employeeID (as EmpID), it has to be inside the sentence as specified above. However, the capture specification as such is only defined as 'more than one character'.

An alternative - if the employeeID turns up in other sentences - is to make the specification stricter, and the anchoring looser. I.e. it could follow either a space or a colon, must start with a capital E, followed by 10 digits exactly, then space.

your base search | rex "[:\s](?<EmpID>E\d{10})\s" 

Hope this helps,

/K

shilpi
New Member

Thanks for this answer..It worked:)

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...