Splunk Search

How to search for numbers appearing only after letters in a field?

PDXKiel
Path Finder

I have a field called CARDFILOGO and I want to search it for ones that start with "JU" and end in numbers. I do not want JU followed by letters so a wild card won't work. What's the best way to get these?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

Would be able to add an additional condition here? I want to get ones starting with JU followed by a number AND ones that start with a "J" followed by numbers.

0 Karma

darrenfuller
Contributor

| regex CARDFILOGO="JU?\d+"

or

| regex CARDFILOGO="(JU|J)\d+"

0 Karma

PDXKiel
Path Finder

Thanks, but both of these seem to get me results where there is a "J" followed by digits so it's picking up ones like FJ10, FJ20 and so on...

0 Karma

PDXKiel
Path Finder

It's long but this seems to get me what I need but I feel like there should be a shorter way to express this:

search CARDFILOGO=JU* OR CARDFILOGO=J0* OR CARDFILOGO=J1* OR CARDFILOGO=J2* OR CARDFILOGO=J3* OR CARDFILOGO=J4* OR CARDFILOGO=J5* OR CARDFILOGO=J6* OR CARDFILOGO=J7* OR CARDFILOGO=J8* OR CARDFILOGO=J9*

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try | regex CARDFILOGO="^JU?\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

That did it, I also did it this way since I know it's a 4 character field and if it starts with a J it will have to have 3 digits after it:
CARDFILOGO="(J\d\d\d|JU\d\d)"

Thanks again for the help!

0 Karma

PDXKiel
Path Finder

Brilliant, that worked! Thanks Rich, I didn't know you could use regex like that!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...