Splunk Search

Search results between a certain number when result has a letter before number e.g C1000

Callum_f
Explorer

Hey Everyone, 

I am trying to search for a field to see how much a customer is spending but there is a letter in front of it.

e.g. "cost" : "C1000" showing they spent $1000. 

So for example I want to search when the user spends between C1000 and C20000. 

is there a way to remove the C and search the numbers of the result?

this is what I have so far

index="silverprod" source=*finance* ("Lambda" "Payload") NOT (lambda-warmer) *topup*

 

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Callum_f 

Can you please try this?

YOUR_SEARCH
| eval cost=replace(cost,"C","") | where cost >500 AND cost < 1500

 

My Sample Search :

|makeresults count=100 | eval a=100| accum a | eval cost="C".a
| rename comment as "Upto Now is sample data only" 
| table cost
| eval cost=replace(cost,"C","") | where cost >500 AND cost < 1500

 

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.


 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...