Splunk Search

How to use rex to match only where the field exactly has 8 characters?

Path Finder

Hello,

I need a search to match when a field that has free form text contains exactly 8 characters that are letters a-z uppercase or lowercase. I only need to view results that have exactly 8 characters in this field.

 index=stats action=click
|rex code8
|table _time,code8
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

View solution in original post

SplunkTrust
SplunkTrust

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

View solution in original post

SplunkTrust
SplunkTrust

This should do it.

index=stats action=click
|regex field=code8 "[A-Za-z]{8}"
|table _time,code8
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

Did not work, but thank you for helping. The answer provided by harsmarvania57 solved my problem.

Thank you.

0 Karma