Splunk Search

regex help

desi-indian
Path Finder

I have the following regex which I am using search time extraction..this returns the field I want but I need to tweak it to show/select the filed only If its a "alphabet" i.e It shld omit /Not match number field

(?i)^(?:[^]]*]){5}\s+(?P[^ ]+)

ex :

As a part of the search extraction ..right now I am getting

ABC
222

I need it to match /return only "ABC" not 222

Thanks for any Help!

Tags (1)
0 Karma

imrago
Contributor
(?i)^(?:[^]]*]){5}s+(?P<fieldname>[a-zA-Z]+)

desi-indian
Path Finder

Actually tried that (After reading http://forums.asp.net/t/1285485.aspx/1 )but some how Its giving only the numbers ..i.e what I want to eliminate which did not make sense as Its supposed to return only alphabets ... I tried negation "!" too i.e something like [^!A-Za-z] but it did not give me what I want .

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...