Splunk Search

How to search a range of numbers?

n179911
New Member

In Splunk, how can I search for a range of numbers (e.g. from "Test213" to "Test220")?

I tried 'test2[13-20]" or 'test2(13-20)" but it does not work?

Any idea?

0 Karma

somesoni2
Revered Legend

The base search (before first pipe) doesn't support regular expression as filter. If you're looking for a string with range of numbers in raw data OR in a field, use regex instead, like this

your base search | regex _raw=".*Test2((1[3-9])|20).*"

OR

your base search | regex yourfield="Test2((1[3-9])|20)"

ddrillic
Ultra Champion
  basesearch 
  | eval test="Test213"
  | rex  field=test "Test(?<test_num>\d\d\d).*"

Seems to work...

0 Karma

ddrillic
Ultra Champion

A little better -

 basesearch 
| eval test="Test2130"
| rex  field=test "Test(?<test_num>(\d).*)"

sundareshr
Legend

Try this "(Test21[3456789]|220)"

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...