Splunk Search

How to search for numbers appearing only after letters in a field?

PDXKiel
Path Finder

I have a field called CARDFILOGO and I want to search it for ones that start with "JU" and end in numbers. I do not want JU followed by letters so a wild card won't work. What's the best way to get these?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

Would be able to add an additional condition here? I want to get ones starting with JU followed by a number AND ones that start with a "J" followed by numbers.

0 Karma

darrenfuller
Contributor

| regex CARDFILOGO="JU?\d+"

or

| regex CARDFILOGO="(JU|J)\d+"

0 Karma

PDXKiel
Path Finder

Thanks, but both of these seem to get me results where there is a "J" followed by digits so it's picking up ones like FJ10, FJ20 and so on...

0 Karma

PDXKiel
Path Finder

It's long but this seems to get me what I need but I feel like there should be a shorter way to express this:

search CARDFILOGO=JU* OR CARDFILOGO=J0* OR CARDFILOGO=J1* OR CARDFILOGO=J2* OR CARDFILOGO=J3* OR CARDFILOGO=J4* OR CARDFILOGO=J5* OR CARDFILOGO=J6* OR CARDFILOGO=J7* OR CARDFILOGO=J8* OR CARDFILOGO=J9*

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try | regex CARDFILOGO="^JU?\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

That did it, I also did it this way since I know it's a 4 character field and if it starts with a J it will have to have 3 digits after it:
CARDFILOGO="(J\d\d\d|JU\d\d)"

Thanks again for the help!

0 Karma

PDXKiel
Path Finder

Brilliant, that worked! Thanks Rich, I didn't know you could use regex like that!

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...