Like this:
index=xyz | regex _raw = "\d{13,}"
index=foo sourcetype=bar | rex "(?<long_number>\d{13,})"
You might add max_match=0 to the rex command
@Landen998 Why
The event may have more than one series of 13 digit numbers. The 13 digit number of interest may not be the first one it finds in the event. The event may not have separated correctly. Any other reason.
So what could be the final search query to display those digits?
Either
index=foo sourcetype=bar | rex max_match=0 "(?<long_number>\d{13,})"
OR
index=xyz | regex _raw = "\d{13,}"
from Woodcock's answer below. All depends on what you want to do. Extract the number (above) or filter events for the number but not extract it (below). .. or you could do both:
index=foo sourcetype=bar | rex max_match=0 "(?<long_number>\d{13,})" | search long_number=*
Thanks it worked