Splunk Search

How to write a regex for string followed by number?

arjun_krishna
Explorer

Below are my 3 logs, i want to write a query, to get all the below 3 logs:

**EXT_CODE*[0-9]** with 1/2/3 digit followed by EXT_CODE

index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

Can some one please suggest the query

my query: index="zync*" EXT_CODE[0-9]*="*" 
0 Karma
1 Solution

mhoogcarspel_sp
Splunk Employee
Splunk Employee

provided that that is the _raw, if you just need to find the events you can use the regex command:

| makeresults

| eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010"
| regex "(EXT|GEN)_CODE\d{1,3}="

View solution in original post

mhoogcarspel_sp
Splunk Employee
Splunk Employee

provided that that is the _raw, if you just need to find the events you can use the regex command:

| makeresults

| eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010"
| regex "(EXT|GEN)_CODE\d{1,3}="

arjun_krishna
Explorer

regex "EXT_CODE\d{1,3}="
This is working for me , but i want both EXT_CODE & GEN_CODE followed by 1/2/3 digit followed (Eg: GEN_CODE017 (or) GEN_CODE001 (or) GEN_CODE999 (or) EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)

0 Karma

tomawest
Path Finder

Does this work? regex "(EXT_CODE\d{1,3}=|GEN_CODE\d{1,3}=)

0 Karma

arjun_krishna
Explorer

@mhoogcarspel , Please respond

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Missed that part

(EXT|GEN)_CODE\d{1,3}=

should work for that

btw, I use regex101 for a lot of these things:
https://regex101.com/r/RfKqEt/2
really great tool

0 Karma

arjun_krishna
Explorer

Great its working for me

0 Karma

493669
Super Champion

can you please share some sample logs and what you need to extract..

0 Karma

arjun_krishna
Explorer

log1: index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
log2: index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
log3: index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

from multiple logs, i have to get above logs which are having EXT_CODE followed by 1/2/3 digit followed (Eg: EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)

0 Karma
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...