Splunk Search

How to use rex to match only where the field exactly has 8 characters?

user93
Communicator

Hello,

I need a search to match when a field that has free form text contains exactly 8 characters that are letters a-z uppercase or lowercase. I only need to view results that have exactly 8 characters in this field.

 index=stats action=click
|rex code8
|table _time,code8
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=stats action=click
|regex field=code8 "[A-Za-z]{8}"
|table _time,code8
---
If this reply helps you, Karma would be appreciated.
0 Karma

user93
Communicator

Did not work, but thank you for helping. The answer provided by harsmarvania57 solved my problem.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...