Splunk Search

How to use rex to match only where the field exactly has 8 characters?

user93
Communicator

Hello,

I need a search to match when a field that has free form text contains exactly 8 characters that are letters a-z uppercase or lowercase. I only need to view results that have exactly 8 characters in this field.

 index=stats action=click
|rex code8
|table _time,code8
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

View solution in original post

harsmarvania57
Ultra Champion

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=stats action=click
|regex field=code8 "[A-Za-z]{8}"
|table _time,code8
---
If this reply helps you, Karma would be appreciated.
0 Karma

user93
Communicator

Did not work, but thank you for helping. The answer provided by harsmarvania57 solved my problem.

Thank you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...