Splunk Search
Highlighted

How to search a range of numbers?

New Member

In Splunk, how can I search for a range of numbers (e.g. from "Test213" to "Test220")?

I tried 'test2[13-20]" or 'test2(13-20)" but it does not work?

Any idea?

0 Karma
Highlighted

Re: How to search a range of numbers?

Legend

Try this "(Test21[3456789]|220)"

0 Karma
Highlighted

Re: How to search a range of numbers?

Ultra Champion
  basesearch 
  | eval test="Test213"
  | rex  field=test "Test(?<test_num>\d\d\d).*"

Seems to work...

0 Karma
Highlighted

Re: How to search a range of numbers?

Ultra Champion

A little better -

 basesearch 
| eval test="Test2130"
| rex  field=test "Test(?<test_num>(\d).*)"
Highlighted

Re: How to search a range of numbers?

SplunkTrust
SplunkTrust

The base search (before first pipe) doesn't support regular expression as filter. If you're looking for a string with range of numbers in raw data OR in a field, use regex instead, like this

your base search | regex _raw=".*Test2((1[3-9])|20).*"

OR

your base search | regex yourfield="Test2((1[3-9])|20)"