Regex field values to look for a specific character Splunk Search

[marktechuk]

Hi guys I'm looking to extract a value from a field using regex, the field contain different types of data such as Id's, emails, name etc..in the same field.
I want a regex to look for a specific alphabetical character for example z thats followed by 10 numeric character for example z1234567890 I dont want to see any of the other values.

tried this (?\w{7,8})" but it also pull the out any other that start with z such as an email address and the the next 10 characters for example zack@abcdhg

Thanks Mt

[mayurr98]

try this

| makeresults | eval data="z1234567890" | rex field=data "(?<field_name>z\d{10})"

this should work for your case

(?<field_name>z\d{10})