Splunk Search

How to use rex to match only where the field exactly has 8 characters?

user93
Communicator

Hello,

I need a search to match when a field that has free form text contains exactly 8 characters that are letters a-z uppercase or lowercase. I only need to view results that have exactly 8 characters in this field.

 index=stats action=click
|rex code8
|table _time,code8
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=stats action=click
|regex field=code8 "[A-Za-z]{8}"
|table _time,code8
---
If this reply helps you, Karma would be appreciated.
0 Karma

user93
Communicator

Did not work, but thank you for helping. The answer provided by harsmarvania57 solved my problem.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...