Splunk Search

How to pattern match with the extracted field

Deprasad
Path Finder

I have a report generated with following fields,

Field 1 , Field 2, Field 3.

I have to create an alert based on the Field 1(it's a phone number field which consists 0-9 , - , +, *) value satisfying below condition.

• Number starts with 101 and is greater than 5 digits
• Number starts with *xy101 and is greater than 8 digits
• Number starts with *xy011 and is greater than 8 digits

0 Karma
1 Solution

jpolvino
Builder

Not 100% sure if you are or are not counting the digits you provided in your counts, or if the "xy" is literally "xy", but this matches the examples you provided:

| rex field="Field 1" "^(101)\d{3,}$|^\*xy(101|011)\d{6,}$"

See https://regex101.com/r/0bioQt/1

If this isn't quite right, please post real examples of fields you are looking to match, and ones you want to reject (do not alert on).

View solution in original post

0 Karma

jpolvino
Builder

Not 100% sure if you are or are not counting the digits you provided in your counts, or if the "xy" is literally "xy", but this matches the examples you provided:

| rex field="Field 1" "^(101)\d{3,}$|^\*xy(101|011)\d{6,}$"

See https://regex101.com/r/0bioQt/1

If this isn't quite right, please post real examples of fields you are looking to match, and ones you want to reject (do not alert on).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use the regex command to filter events to those containing the proper number sequence.

... | regex Field1="(^101\d{2,}|^\*xy[10]{2}1\d{6,})" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...