Splunk Search

Regex

nathanluke86
Communicator

Hi,

I am trying to find unique id's the have 3 letters followed by 6 numbers for example

 

bhg111111

 

My issue is I want to not count duplicates and would like to do this within the regex itself (not dedup by field.

 

is this possible

 

thanks,

Labels (1)
0 Karma

493669
Super Champion

Hi @nathanluke86 

You can use Stats like below-

...|stats count by fieldname

 Here It will give Unique values of fieldname with count and If count is not required you can remove it using 

|fields - count

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So still not completely within the rex (which I am not sure you could do anyway) and based @493669 suggestion

--- your search
| rex field=yourfield max_match=0 "(?<id>[a-zA-Z]{3}\d{6})"
| stats count by id
| fields - count
0 Karma

nathanluke86
Communicator

hi @ITWhisperer 

yes thats exactly what I am trying to achieve,

Kind regards,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @nathanluke86 

Why do you not want to use dedup, it does what you need to do a lot easier than trying to write some complicated alternative?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Just to clarify, your field could contain multiple occurrences of this pattern and you want to count the unique occurrences but you don't want to use dedup?

bhg111111 bhg111111 bhg222222 is two matches?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...