Splunk Search

How do I return a search for a field that contains a number?

jbala1
Engager

example:

If I have a list of user and I want to search and the users who only have a number in that field;

John_doe
John_doe1
Jane_doe
Jane_doe2

How do I return just the users with numbers associated to their field?

Tags (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

this regex will return all field "UserName" which are having a number.

 your base search | regex UserName="\w+\d"

tested this and its working fine -
to list all hosts which are having a digit/number in them -

index=_internal | regex host="\w+\d"

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

this regex will return all field "UserName" which are having a number.

 your base search | regex UserName="\w+\d"

tested this and its working fine -
to list all hosts which are having a digit/number in them -

index=_internal | regex host="\w+\d"

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jbala1
Engager

Thank you. That answer solved my problem.

0 Karma

cmerriman
Super Champion

how about

|eval userNumbers=match(userField,"\d")

that should give you a true/false of users with digits in their username and you can search from there.

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...