Splunk Search

How do I perform a match on a field ONLY on letters that are followed by numbers?

jsven7
Communicator

Suppose I have a field like this: a1234

Is there a way to grab all the letters that are immediately followed by numbers? I know I can substr the first position but I want be able to work with this for example too: abc1234.

Ty in advance

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm not clear about what you want to accomplish, but I think the rex command will do what you want. This command will extract the letters from a field containing letters followed by numbers and put them in a field called 'letters'.

... | rex field=foo "(?<letters>[a-zA-Z]+)\d+" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm not clear about what you want to accomplish, but I think the rex command will do what you want. This command will extract the letters from a field containing letters followed by numbers and put them in a field called 'letters'.

... | rex field=foo "(?<letters>[a-zA-Z]+)\d+" | ...
---
If this reply helps you, Karma would be appreciated.

jsven7
Communicator

Thank you for this. What if I want to specify letters or a combination of letters and numbers that follow numbers?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

For letters that follow numbers:

"(?<foo>\d+)[a-zA-Z]+"

For letters and number following numbers:

"(?<foo>\d+)[a-zA-Z0-9]+"

regex101.com is a great site for experimenting with regular expressions.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jsven7
Communicator

This is really helpful ty!

0 Karma

acharlieh
Influencer

Then you modify the bracket expression: [a-zA-Z] which currently says "Match a single character that is either a to z, or A to Z" For example if you wanted only to match one of the lower case versions of the letters that Vanna White gives you for free in the bonus round: [rstlne] (The plus sign after this expression says instead of just one, I want one or more, as many times as I can up front)

There is a lot of nuances to crafting regular expressions for example, if a digit is one of the characters you want to match and also ensure is following... depending on requirements may not be possible, or may involve lookahead and lookbehind expressions, I would recommend taking some of your example data and playing with a online tester such as https://regex101.com/ or if you want some practice at building regular expressions play some regex golf: http://regex.alf.nu/

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...