Splunk Search

How to write a regex for string followed by number?

Explorer

Below are my 3 logs, i want to write a query, to get all the below 3 logs:

**EXT_CODE*[0-9]** with 1/2/3 digit followed by EXT_CODE

index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

Can some one please suggest the query

my query: index="zync*" EXT_CODE[0-9]*="*" 
0 Karma
1 Solution

Splunk Employee
Splunk Employee

provided that that is the _raw, if you just need to find the events you can use the regex command:

| makeresults

| eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010"
| regex "(EXT|GEN)_CODE\d{1,3}="

View solution in original post

Splunk Employee
Splunk Employee

provided that that is the _raw, if you just need to find the events you can use the regex command:

| makeresults

| eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010"
| regex "(EXT|GEN)_CODE\d{1,3}="

View solution in original post

Explorer

regex "EXT_CODE\d{1,3}="
This is working for me , but i want both EXT_CODE & GEN_CODE followed by 1/2/3 digit followed (Eg: GEN_CODE017 (or) GEN_CODE001 (or) GEN_CODE999 (or) EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)

0 Karma

Path Finder

Does this work? regex "(EXT_CODE\d{1,3}=|GEN_CODE\d{1,3}=)

0 Karma

Explorer

@mhoogcarspel , Please respond

0 Karma

Splunk Employee
Splunk Employee

Missed that part

(EXT|GEN)_CODE\d{1,3}=

should work for that

btw, I use regex101 for a lot of these things:
https://regex101.com/r/RfKqEt/2
really great tool

0 Karma

Explorer

Great its working for me

0 Karma

Super Champion

can you please share some sample logs and what you need to extract..

0 Karma

Explorer

log1: index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
log2: index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
log3: index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

from multiple logs, i have to get above logs which are having EXT_CODE followed by 1/2/3 digit followed (Eg: EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!