Splunk Search

How to search for numbers appearing only after letters in a field?

PDXKiel
Path Finder

I have a field called CARDFILOGO and I want to search it for ones that start with "JU" and end in numbers. I do not want JU followed by letters so a wild card won't work. What's the best way to get these?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

Would be able to add an additional condition here? I want to get ones starting with JU followed by a number AND ones that start with a "J" followed by numbers.

0 Karma

darrenfuller
Contributor

| regex CARDFILOGO="JU?\d+"

or

| regex CARDFILOGO="(JU|J)\d+"

0 Karma

PDXKiel
Path Finder

Thanks, but both of these seem to get me results where there is a "J" followed by digits so it's picking up ones like FJ10, FJ20 and so on...

0 Karma

PDXKiel
Path Finder

It's long but this seems to get me what I need but I feel like there should be a shorter way to express this:

search CARDFILOGO=JU* OR CARDFILOGO=J0* OR CARDFILOGO=J1* OR CARDFILOGO=J2* OR CARDFILOGO=J3* OR CARDFILOGO=J4* OR CARDFILOGO=J5* OR CARDFILOGO=J6* OR CARDFILOGO=J7* OR CARDFILOGO=J8* OR CARDFILOGO=J9*

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try | regex CARDFILOGO="^JU?\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

That did it, I also did it this way since I know it's a 4 character field and if it starts with a J it will have to have 3 digits after it:
CARDFILOGO="(J\d\d\d|JU\d\d)"

Thanks again for the help!

0 Karma

PDXKiel
Path Finder

Brilliant, that worked! Thanks Rich, I didn't know you could use regex like that!

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...