Splunk Search

How to get Splunk to ignore field values with numbers?

lbogle
Contributor

Hello Splunkers,
I need to ignore some field values that are incorrectly coming in.
I am seeing a field UserID=Tom correctly show up but there are some other entries where UserID=8.8.8.8 Accessed URL....etc etc.
How do I get Splunk to ignore any UserID where UserID=Anything with a number in it?
Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Maybe this will help?

... | rex field=UserID "[a-zA-Z]?" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Are these invalid values present in the logs/raw data itself? Do you have any field extractions setup for this field?

You may want to read this documentation as well.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad

0 Karma

lbogle
Contributor

Hello,
Yes, this is working with a field extraction. I was not able to filter the extraction 100% successfully but it's providing good data, I just need to be able to filter out the numerical values at search time. This is for a single search instance for doing some detective work and is not a long term requirement.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...