Splunk Search

How to use rex to match only where the field exactly has 8 characters?

user93
Communicator

Hello,

I need a search to match when a field that has free form text contains exactly 8 characters that are letters a-z uppercase or lowercase. I only need to view results that have exactly 8 characters in this field.

 index=stats action=click
|rex code8
|table _time,code8
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=stats action=click
|regex field=code8 "[A-Za-z]{8}"
|table _time,code8
---
If this reply helps you, Karma would be appreciated.
0 Karma

user93
Communicator

Did not work, but thank you for helping. The answer provided by harsmarvania57 solved my problem.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...