Regex for fetching number - Splunk Community

Splunk Search

how to use regex yo fetch Incident (eg: INC0000453245 or INC0000342568)

to fetch INC and exactly 10 numbers after INC??

Regular expressions in Splunk

| rex “(?<number>INC\d{10})”

you might need to replace double quotes from your keyboard.

————————————
If this helps, give a like below.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...