Splunk Search

regex question

nathanluke86
Communicator

I am trying to get exactly 10 digits which might be between white spaces or symbols etc:

1234567890
,234567890 , 1234567890
:1234567890

etc etc

but not 10 digits from a string of 11+ digits etc

There are no unique digits within these 10 digit ID's I am trying to identify. I am just trying to get as close as possible without generating to many false positives

TIA

TIA

Tags (1)
0 Karma
1 Solution

javiergn
Super Champion

Hi @nathanluke86,

Assuming I fully understood your requirements, the following SPL should do the trick:

| rex max_match=0 "\b(?<id>\d{10})\b"
| mvexpand id

Max match will capture any occurrences of 10 digits in you event and place the values into a multivalued field named id. You can then expand id if you want those multivalue fields to be displayed individually or just leave them as they are.

Hope that makes sense.

Regards,
J

Edited: fixing a typo on the regex as I couldn't test this on a Splunk instance

View solution in original post

to4kawa
Ultra Champion
index=yours
| regex "\b\d{10})\b"
| rex max_match=0 "\b(?<id>\d{10})\b"

at first, search what you want.

0 Karma

javiergn
Super Champion

Hi @nathanluke86,

Assuming I fully understood your requirements, the following SPL should do the trick:

| rex max_match=0 "\b(?<id>\d{10})\b"
| mvexpand id

Max match will capture any occurrences of 10 digits in you event and place the values into a multivalued field named id. You can then expand id if you want those multivalue fields to be displayed individually or just leave them as they are.

Hope that makes sense.

Regards,
J

Edited: fixing a typo on the regex as I couldn't test this on a Splunk instance

javiergn
Super Champion

Hi @nathanluke86, don't forget to accept one of the answers if your problem is now solved.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nathanluke86,
could you share an example of your logs?
Ciao.
Giuseppe

0 Karma

nathanluke86
Communicator

@gcusello

I don't have specific logs to search. I just need to search all indexes index=* for exactly 10 digit strings that are between white spaces or symbols as above

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nathanluke86,
you could use something like this:

index=your_index 
| rex max_match=0 "\b(?<your_id>\d{10})\b"

Ciao.
Giuseppe

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...