Splunk Search

How to write a regex for string followed by number?

arjun_krishna
Explorer

Below are my 3 logs, i want to write a query, to get all the below 3 logs:

**EXT_CODE*[0-9]** with 1/2/3 digit followed by EXT_CODE

index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

Can some one please suggest the query

my query: index="zync*" EXT_CODE[0-9]*="*" 
0 Karma
1 Solution

mhoogcarspel_sp
Splunk Employee
Splunk Employee

provided that that is the _raw, if you just need to find the events you can use the regex command:

| makeresults

| eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010"
| regex "(EXT|GEN)_CODE\d{1,3}="

View solution in original post

mhoogcarspel_sp
Splunk Employee
Splunk Employee

provided that that is the _raw, if you just need to find the events you can use the regex command:

| makeresults

| eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010"
| regex "(EXT|GEN)_CODE\d{1,3}="

arjun_krishna
Explorer

regex "EXT_CODE\d{1,3}="
This is working for me , but i want both EXT_CODE & GEN_CODE followed by 1/2/3 digit followed (Eg: GEN_CODE017 (or) GEN_CODE001 (or) GEN_CODE999 (or) EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)

0 Karma

tomawest
Path Finder

Does this work? regex "(EXT_CODE\d{1,3}=|GEN_CODE\d{1,3}=)

0 Karma

arjun_krishna
Explorer

@mhoogcarspel , Please respond

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Missed that part

(EXT|GEN)_CODE\d{1,3}=

should work for that

btw, I use regex101 for a lot of these things:
https://regex101.com/r/RfKqEt/2
really great tool

0 Karma

arjun_krishna
Explorer

Great its working for me

0 Karma

493669
Super Champion

can you please share some sample logs and what you need to extract..

0 Karma

arjun_krishna
Explorer

log1: index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
log2: index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
log3: index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

from multiple logs, i have to get above logs which are having EXT_CODE followed by 1/2/3 digit followed (Eg: EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...