Splunk Search

'How do I use regex in Splunk to pull out numbers and decimals and not letters;?

New Member

For instance: the results have 01.2.3 and ABC5. How do I only pull out 01.2.3?

Tags (2)
0 Karma


Sounds like you're looking for something that matches "starts with a number, followed by 1 or more numbers and periods." If so, then this might work:

| rex "^\d[\d\.]+"

If the string you're trying to extract is part of a larger field value, then:

| rex ".*(?<token>\d[\d\.]+)"

If you have an event with and without the text you are trying to extract, please post it. Often, the text before and after what you're trying to extract can help make the rex more accurate.

0 Karma

Revered Legend

Assuming you want to filter results if a field value contains one or more alphanumeric character (and keep the one with numbers and decimal), then try something like this:

your current search
| regex fieldName!=".+[A-z].+"
0 Karma


The following regex :

| rex "(?<new_fieldname>\d+\.\d+\.\d+)"

Should produce new_fieldname=01.2.3

\d -> only matches number characters
\. -> matches a literal period (.)

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...