Splunk Search

How do I perform a match on a field ONLY on letters that are followed by numbers?

jsven7
Communicator

Suppose I have a field like this: a1234

Is there a way to grab all the letters that are immediately followed by numbers? I know I can substr the first position but I want be able to work with this for example too: abc1234.

Ty in advance

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm not clear about what you want to accomplish, but I think the rex command will do what you want. This command will extract the letters from a field containing letters followed by numbers and put them in a field called 'letters'.

... | rex field=foo "(?<letters>[a-zA-Z]+)\d+" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm not clear about what you want to accomplish, but I think the rex command will do what you want. This command will extract the letters from a field containing letters followed by numbers and put them in a field called 'letters'.

... | rex field=foo "(?<letters>[a-zA-Z]+)\d+" | ...
---
If this reply helps you, Karma would be appreciated.

jsven7
Communicator

Thank you for this. What if I want to specify letters or a combination of letters and numbers that follow numbers?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

For letters that follow numbers:

"(?<foo>\d+)[a-zA-Z]+"

For letters and number following numbers:

"(?<foo>\d+)[a-zA-Z0-9]+"

regex101.com is a great site for experimenting with regular expressions.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jsven7
Communicator

This is really helpful ty!

0 Karma

acharlieh
Influencer

Then you modify the bracket expression: [a-zA-Z] which currently says "Match a single character that is either a to z, or A to Z" For example if you wanted only to match one of the lower case versions of the letters that Vanna White gives you for free in the bonus round: [rstlne] (The plus sign after this expression says instead of just one, I want one or more, as many times as I can up front)

There is a lot of nuances to crafting regular expressions for example, if a digit is one of the characters you want to match and also ensure is following... depending on requirements may not be possible, or may involve lookahead and lookbehind expressions, I would recommend taking some of your example data and playing with a online tester such as https://regex101.com/ or if you want some practice at building regular expressions play some regex golf: http://regex.alf.nu/

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...