Splunk Search

How to get Splunk to ignore field values with numbers?

lbogle
Contributor

Hello Splunkers,
I need to ignore some field values that are incorrectly coming in.
I am seeing a field UserID=Tom correctly show up but there are some other entries where UserID=8.8.8.8 Accessed URL....etc etc.
How do I get Splunk to ignore any UserID where UserID=Anything with a number in it?
Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Maybe this will help?

... | rex field=UserID "[a-zA-Z]?" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Are these invalid values present in the logs/raw data itself? Do you have any field extractions setup for this field?

You may want to read this documentation as well.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad

0 Karma

lbogle
Contributor

Hello,
Yes, this is working with a field extraction. I was not able to filter the extraction 100% successfully but it's providing good data, I just need to be able to filter out the numerical values at search time. This is for a single search instance for doing some detective work and is not a long term requirement.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...