'How do I use regex in Splunk to pull out numbers and decimals and not letters;?

[ESPrioleau]

For instance: the results have 01.2.3 and ABC5. How do I only pull out 01.2.3?

[jpolvino]

Sounds like you're looking for something that matches "starts with a number, followed by 1 or more numbers and periods." If so, then this might work:

| rex "^\d[\d\.]+"

If the string you're trying to extract is part of a larger field value, then:

| rex ".*(?<token>\d[\d\.]+)"

If you have an event with and without the text you are trying to extract, please post it. Often, the text before and after what you're trying to extract can help make the rex more accurate.

[somesoni2]

Assuming you want to filter results if a field value contains one or more alphanumeric character (and keep the one with numbers and decimal), then try something like this:

your current search
| regex fieldName!=".+[A-z].+"

[solarboyz1]

The following regex :

| rex "(?<new_fieldname>\d+\.\d+\.\d+)"

Should produce new_fieldname=01.2.3

\d -> only matches number characters
\. -> matches a literal period (.)