Splunk Search
Highlighted

regex question

Communicator

I am trying to get exactly 10 digits which might be between white spaces or symbols etc:

1234567890
,234567890 , 1234567890
:1234567890

etc etc

but not 10 digits from a string of 11+ digits etc

There are no unique digits within these 10 digit ID's I am trying to identify. I am just trying to get as close as possible without generating to many false positives

TIA

TIA

Tags (1)
0 Karma
Highlighted

Re: regex question

Legend

Hi @nathanluke86,
could you share an example of your logs?
Ciao.
Giuseppe

0 Karma
Highlighted

Re: regex question

Communicator

@gcusello

I don't have specific logs to search. I just need to search all indexes index=* for exactly 10 digit strings that are between white spaces or symbols as above

Thanks

0 Karma
Highlighted

Re: regex question

Legend

Hi @nathanluke86,
you could use something like this:

index=your_index 
| rex max_match=0 "\b(?<your_id>\d{10})\b"

Ciao.
Giuseppe

Highlighted

Re: regex question

SplunkTrust
SplunkTrust

Hi @nathanluke86,

Assuming I fully understood your requirements, the following SPL should do the trick:

| rex max_match=0 "\b(?<id>\d{10})\b"
| mvexpand id

Max match will capture any occurrences of 10 digits in you event and place the values into a multivalued field named id. You can then expand id if you want those multivalue fields to be displayed individually or just leave them as they are.

Hope that makes sense.

Regards,
J

Edited: fixing a typo on the regex as I couldn't test this on a Splunk instance

View solution in original post

Highlighted

Re: regex question

SplunkTrust
SplunkTrust

Hi @nathanluke86, don't forget to accept one of the answers if your problem is now solved.

0 Karma
Highlighted

Re: regex question

Ultra Champion
index=yours
| regex "\b\d{10})\b"
| rex max_match=0 "\b(?<id>\d{10})\b"

at first, search what you want.

0 Karma