How to use rex to match only where the field exactly has 8 characters?

[user93]

Hello,

I need a search to match when a field that has free form text contains exactly 8 characters that are letters a-z uppercase or lowercase. I only need to view results that have exactly 8 characters in this field.

 index=stats action=click
|rex code8
|table _time,code8

[harsmarvania57 · Accepted solution]

Hi,

Try below query, replace <yourfieldname> with your exact fieldname

index=stats action=click
| regex <yourfieldname>="^[a-zA-Z]{8}$"

[richgalloway]

This should do it.

index=stats action=click
|regex field=code8 "[A-Za-z]{8}"
|table _time,code8

[user93]

Did not work, but thank you for helping. The answer provided by harsmarvania57 solved my problem.

Thank you.