How to extract a number of a string and check the count?

[zoe]

Hi, 

I have data like A-001, A-002, A-003.....

I would like to know how to extract the numbers from these strings: 001, 002, 003....so that I can generate an alert: every three batche (001, 004, 007) should be check.

Can someone help me with that? Thanks1

Regards,

Tong 

[gcusello · Accepted solution]

Hi @zoe,

if the format is always the same, you can use a regex like this:

index=your_index 
| rex "A-(?<number>\d+)"
| stats count BY number

you can test the regex at https://regex101.com/r/H1gAHF/1

Ciao.

Giuseppe

[zoe]

Hi @gcusello ,

great! Thanks for the Tipp. It is exactly what I want. Many thanks!

Regards,

Tong

[gcusello]

hi @zoe,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉