https://community.splunk.com/t5/Reporting/cdr-analysis-area-code/m-p/49072#M10231 <P>Grab the first 3 digits - there are multiple ways to do this. Either you use <CODE>eval</CODE> and <CODE>substr</CODE>:</P> <PRE><CODE>... | eval areacode=substr(yourphonefield,1,3) </CODE></PRE> <P>Or you could use <CODE>rex</CODE>:</P> <PRE><CODE>... | rex field=yourphonefield "^(?&lt;areacode&gt;\d{3})" </CODE></PRE> Thu, 29 Nov 2012 16:02:25 GMT Ayn 2012-11-29T16:02:25Z https://community.splunk.com/t5/Reporting/cdr-analysis-area-code/m-p/49071#M10230 <P>Hi,</P> <P>I have field which contains telephonenumbers and would like to create a report on area codes, so I need to only use the first 3 digits of the field.</P> <P>How is this done?</P> Thu, 29 Nov 2012 15:39:18 GMT https://community.splunk.com/t5/Reporting/cdr-analysis-area-code/m-p/49071#M10230 HansK 2012-11-29T15:39:18Z https://community.splunk.com/t5/Reporting/cdr-analysis-area-code/m-p/49072#M10231 <P>Grab the first 3 digits - there are multiple ways to do this. Either you use <CODE>eval</CODE> and <CODE>substr</CODE>:</P> <PRE><CODE>... | eval areacode=substr(yourphonefield,1,3) </CODE></PRE> <P>Or you could use <CODE>rex</CODE>:</P> <PRE><CODE>... | rex field=yourphonefield "^(?&lt;areacode&gt;\d{3})" </CODE></PRE> Thu, 29 Nov 2012 16:02:25 GMT https://community.splunk.com/t5/Reporting/cdr-analysis-area-code/m-p/49072#M10231 Ayn 2012-11-29T16:02:25Z