How to extract seven digit number with no special characters or white space before/after?

[rhenry]

Hello,

I am attempting to extract from a field a seven digit number which can sometimes have a space or special character such as # in front of it. I want to be able to output it such that the new field only returns the seven digit number, no special characters or white space before and after. Also, I want to set it such that it will exclude where the seven digit number begins with zero. So far, I have only been able to come up with and tried the following in regular expression:

(?<Field1>\d\d\d\d\d\d\d) *Pulls less than seven digits as well; need exactly seven.

(?<Field1>[^a-zA-Z]\d{7}) *Does not omit special characters before it and pulls seven digit numbers of 0000000 (want to exclude these).

Can I get some assistance on what the correct regular expression is to be able to pull a seven digit number with no special characters or space before/after and not all zeroes? Thanks!

[ITWhisperer]

Does this work for you?

(?<Field1>[1-9]\d{6})

[gcusello]

Hi @rhenry,

could you share some sample of your logs, highlighting the part of logs to take.

Ciao.

Giuseppe

[rhenry]

I can give an example:

“The analysis of the log shows for website http://www.somewebsite.com/url-id/1234567abc124def343 there was a malicious attack, ID #1234567.”

In the example above, I only want to pull the second number with ID in front of it. I do not want to pull the seven digit number in the url above. Does that make sense?

[gcusello · Accepted solution]

Hi @rhenry,

if you always have "#" before the number, you could use something like this:

| rex "\#(?<ID>\d{7})"

that you can test at https://regex101.com/r/aQEFp4/1

if there could be other conditions, please share some example.

Ciao.

Giuseppe

[rhenry]

This is helpful.

So, drilling down on the first example, I want to be be able to specifically locate where it begins with "ID" and then capture that seven digit number afterward. I might have some cases where a different word would appear before it (i.e. "Investigation" or "Incident"). Is it possible to write a regular expression where it will look for multiple words and capture the seven digit number following it? Thanks!

[gcusello]

Hi @rhenry,

yes it's possible, but to help you I need some examples of the various logs that's possible to parse.

Ciao.

Giuseppe

[rhenry]

I think I have found the solution to my problem. Thanks!

[gcusello]

Hi @rhenry,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contyributors  😉

[ITWhisperer]

(incident\s|investigation\s|ID\s\#)(?<ID>[1-9]\d\d\d\d\d\d)