Splunk Search

How to extract a number of a string and check the count?

zoe
Path Finder

Hi, 

I have data like A-001, A-002, A-003.....

I would like to know how to extract the numbers from these strings: 001, 002, 003....so that I can generate an alert: every three batche (001, 004, 007) should be check.

Can someone help me with that? Thanks1

 

Regards,

Tong 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @zoe,

if the format is always the same, you can use a regex like this:

index=your_index 
| rex "A-(?<number>\d+)"
| stats count BY number

you can test the regex at https://regex101.com/r/H1gAHF/1

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoe,

if the format is always the same, you can use a regex like this:

index=your_index 
| rex "A-(?<number>\d+)"
| stats count BY number

you can test the regex at https://regex101.com/r/H1gAHF/1

Ciao.

Giuseppe

0 Karma

zoe
Path Finder

Hi @gcusello ,

 

great! Thanks for the Tipp. It is exactly what I want. Many thanks!

 

Regards,

Tong

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @zoe,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...