Splunk Search

How to get only search result to shows only for the match that has 18 alphanumeric character from the list?

akshayinnamuri
Loves-to-Learn Lots

Hi 
Ouput of my search result shows

 

FieldA

=========

abcdabcdabcd001234

abcdef-gef

exyza-123

xxxxyyyy-abcd

 

 

how to check or search for value of the result of FieldA that has only 18 characters

 

thanks in advance

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Your title says 18 alphanumeric characters (which doesn't include punctuations like hyphen), but the text says 18 characters.  Which is it?

To filter 18 alphanumeric characters, do

| rex field=FieldA "^(<w18>\w{18})$"
| where FieldA == w18

To filter for any 18 character

| rex field=FieldA "^(<c18>.{18})$"
| where FieldA == c18

 or, more efficiently,

| where len(FieldA) == 18
Tags (2)
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...