In Splunk, how can I search for a range of numbers (e.g. from "Test213" to "Test220")?
I tried 'test2[13-20]" or 'test2(13-20)" but it does not work?
Any idea?
The base search (before first pipe) doesn't support regular expression as filter. If you're looking for a string with range of numbers in raw data OR in a field, use regex instead, like this
your base search | regex _raw=".*Test2((1[3-9])|20).*"
OR
your base search | regex yourfield="Test2((1[3-9])|20)"
basesearch
| eval test="Test213"
| rex field=test "Test(?<test_num>\d\d\d).*"
Seems to work...
A little better -
basesearch
| eval test="Test2130"
| rex field=test "Test(?<test_num>(\d).*)"
Try this "(Test21[3456789]|220)"