Splunk Search

'How do I use regex in Splunk to pull out numbers and decimals and not letters;?

ESPrioleau
New Member

For instance: the results have 01.2.3 and ABC5. How do I only pull out 01.2.3?

Tags (2)
0 Karma

jpolvino
Builder

Sounds like you're looking for something that matches "starts with a number, followed by 1 or more numbers and periods." If so, then this might work:

| rex "^\d[\d\.]+"

If the string you're trying to extract is part of a larger field value, then:

| rex ".*(?<token>\d[\d\.]+)"

If you have an event with and without the text you are trying to extract, please post it. Often, the text before and after what you're trying to extract can help make the rex more accurate.

0 Karma

somesoni2
Revered Legend

Assuming you want to filter results if a field value contains one or more alphanumeric character (and keep the one with numbers and decimal), then try something like this:

your current search
| regex fieldName!=".+[A-z].+"
0 Karma

solarboyz1
Builder

The following regex :

| rex "(?<new_fieldname>\d+\.\d+\.\d+)"

Should produce new_fieldname=01.2.3

\d -> only matches number characters
\. -> matches a literal period (.)

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...