Splunk Search

How do I perform a match on a field ONLY on letters that are followed by numbers?

jsven7
Communicator

Suppose I have a field like this: a1234

Is there a way to grab all the letters that are immediately followed by numbers? I know I can substr the first position but I want be able to work with this for example too: abc1234.

Ty in advance

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm not clear about what you want to accomplish, but I think the rex command will do what you want. This command will extract the letters from a field containing letters followed by numbers and put them in a field called 'letters'.

... | rex field=foo "(?<letters>[a-zA-Z]+)\d+" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm not clear about what you want to accomplish, but I think the rex command will do what you want. This command will extract the letters from a field containing letters followed by numbers and put them in a field called 'letters'.

... | rex field=foo "(?<letters>[a-zA-Z]+)\d+" | ...
---
If this reply helps you, Karma would be appreciated.

jsven7
Communicator

Thank you for this. What if I want to specify letters or a combination of letters and numbers that follow numbers?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

For letters that follow numbers:

"(?<foo>\d+)[a-zA-Z]+"

For letters and number following numbers:

"(?<foo>\d+)[a-zA-Z0-9]+"

regex101.com is a great site for experimenting with regular expressions.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jsven7
Communicator

This is really helpful ty!

0 Karma

acharlieh
Influencer

Then you modify the bracket expression: [a-zA-Z] which currently says "Match a single character that is either a to z, or A to Z" For example if you wanted only to match one of the lower case versions of the letters that Vanna White gives you for free in the bonus round: [rstlne] (The plus sign after this expression says instead of just one, I want one or more, as many times as I can up front)

There is a lot of nuances to crafting regular expressions for example, if a digit is one of the characters you want to match and also ensure is following... depending on requirements may not be possible, or may involve lookahead and lookbehind expressions, I would recommend taking some of your example data and playing with a online tester such as https://regex101.com/ or if you want some practice at building regular expressions play some regex golf: http://regex.alf.nu/

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...