Splunk Search

How to generate a search that will only display results where a field contains some non-alphanumeric characters?

drinkingjimmy
Explorer

A field is named product. I want to produce a list of products in my source, which are not made up of only english alphanumeric characters (any length).
I.e. Products:
Dog Collar
18 inch Dog Collar
20-inch Dog Collar
Ƨhock collar

would yield only:
20-inch Dog Collar
Ƨhock collar

(Because of the latin character and the hyphen.)

I've seen plenty of uses of sed to remove/replace the non-alphanumerics, but I don't want to remove, just get a list of the outliers.

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this. First two lines are to generate sample data. You need to replace that with your search.

| gentimes start=-1 | eval Product="Dog Collar#18 inch Dog Collar#20-inch Dog Collar#Ƨhock collar" | table Product | makemv Product delim="#" | mvexpand Product 
| regex Product!="^[A-z\s0-9]+$"

This will keep events which have Product with any non-alphanumeric character.

View solution in original post

somesoni2
Revered Legend

Try like this. First two lines are to generate sample data. You need to replace that with your search.

| gentimes start=-1 | eval Product="Dog Collar#18 inch Dog Collar#20-inch Dog Collar#Ƨhock collar" | table Product | makemv Product delim="#" | mvexpand Product 
| regex Product!="^[A-z\s0-9]+$"

This will keep events which have Product with any non-alphanumeric character.

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...