Splunk Search

How to search for numbers appearing only after letters in a field?

PDXKiel
Path Finder

I have a field called CARDFILOGO and I want to search it for ones that start with "JU" and end in numbers. I do not want JU followed by letters so a wild card won't work. What's the best way to get these?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try ... | regex CARDFILOGO="JU\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

Would be able to add an additional condition here? I want to get ones starting with JU followed by a number AND ones that start with a "J" followed by numbers.

0 Karma

darrenfuller
Contributor

| regex CARDFILOGO="JU?\d+"

or

| regex CARDFILOGO="(JU|J)\d+"

0 Karma

PDXKiel
Path Finder

Thanks, but both of these seem to get me results where there is a "J" followed by digits so it's picking up ones like FJ10, FJ20 and so on...

0 Karma

PDXKiel
Path Finder

It's long but this seems to get me what I need but I feel like there should be a shorter way to express this:

search CARDFILOGO=JU* OR CARDFILOGO=J0* OR CARDFILOGO=J1* OR CARDFILOGO=J2* OR CARDFILOGO=J3* OR CARDFILOGO=J4* OR CARDFILOGO=J5* OR CARDFILOGO=J6* OR CARDFILOGO=J7* OR CARDFILOGO=J8* OR CARDFILOGO=J9*

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try | regex CARDFILOGO="^JU?\d+".

---
If this reply helps you, Karma would be appreciated.
0 Karma

PDXKiel
Path Finder

That did it, I also did it this way since I know it's a 4 character field and if it starts with a J it will have to have 3 digits after it:
CARDFILOGO="(J\d\d\d|JU\d\d)"

Thanks again for the help!

0 Karma

PDXKiel
Path Finder

Brilliant, that worked! Thanks Rich, I didn't know you could use regex like that!

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...