Splunk Search

how to search a number which is 13 digits or more using regex in splunk?

pavanae
Builder

Hi how can i find out a number which is 13 digits or more in a splunk search on index="xyz". Please let me know

Tags (4)
0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee
index=foo sourcetype=bar | rex "(?<long_number>\d{13,})"

View solution in original post

woodcock
Esteemed Legend

Like this:

index=xyz | regex _raw = "\d{13,}"

aljohnson_splun
Splunk Employee
Splunk Employee
index=foo sourcetype=bar | rex "(?<long_number>\d{13,})"

landen99
Motivator

You might add max_match=0 to the rex command

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

@Landen998 Why

0 Karma

landen99
Motivator

The event may have more than one series of 13 digit numbers. The 13 digit number of interest may not be the first one it finds in the event. The event may not have separated correctly. Any other reason.

0 Karma

pavanae
Builder

So what could be the final search query to display those digits?

0 Karma

landen99
Motivator

Either

index=foo sourcetype=bar | rex max_match=0 "(?<long_number>\d{13,})"

OR

index=xyz | regex _raw = "\d{13,}"

from Woodcock's answer below. All depends on what you want to do. Extract the number (above) or filter events for the number but not extract it (below). .. or you could do both:

index=foo sourcetype=bar | rex max_match=0 "(?<long_number>\d{13,})" | search long_number=*
0 Karma

pavanae
Builder

Thanks it worked

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...