Splunk Search

How to show fields that contain one or more camelCase strings?

rms_rms
Explorer

Show if field "subject" contains one or more camel case strings like:

LuckyChance to Receive a FREE IpadPro! ClaimNow!

I'm having a hard time creating a regex for this.

Please help.

 

Thank you.

 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust
| eval isCamelCase=if(match(subject, "([A-Z]([a-z0-9]+)){2,}"), 1, 0)

that will look for two or more capitalised words, which are followed by one or more lower case/numeric values

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Very simple regex looks for 1 capital followed by a lower case.

Is that enough?

| eval isCamelCase=if(match(subject, "[A-Z][a-z]"), 1, 0)
0 Karma

rms_rms
Explorer

Unfortunately, it's detecting subjects which have somewhat valid capitalization.

1Your Monday afternoon trip with Uber
1

Our SUPER Club Benefit

0 I RECORDED YOU!

 

I would like to identify subjects that contains concatenated strings like "LuckyChance" and "DysonVacuum" from the sample below:

LuckyChance to Receive a FREE DysonVacuum!

 

Thank you.

Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust
| eval isCamelCase=if(match(subject, "([A-Z]([a-z0-9]+)){2,}"), 1, 0)

that will look for two or more capitalised words, which are followed by one or more lower case/numeric values

rms_rms
Explorer

This works!

Thank you.

0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...