https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417164#M120064 <P>| means OR. If it works, please accept the answer.</P> Thu, 28 Feb 2019 15:43:03 GMT vnravikumar 2019-02-28T15:43:03Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417159#M120059 <P>Hi Experts,</P> <P>How can I get events on a numeric field where a 7 digit number begins with 11?</P> <P>I tried with ...my search... field=="11*" but it is not matching all the numbers.</P> <P>Sample data:</P> <PRE><CODE>1166538 1212345 1116934 3331234 6037211,1166000 6037233,6031111 4160309,1118905 7031671,1117162 1186934,7038716 8016102,1187282 1176438,5254111,8925627 1175538,5254112,8925629 5254146,1178001,8925478,8925755 5254125,5268008,8925492,8925785 </CODE></PRE> <P>Events expected to be included containing - any 7-digit-number that begins with 11XXXXX:</P> <PRE><CODE>1166538 1116934 6037211,1166000 4160309,1118905 7031671,1117162 1186934,7038716 8016102,1187282 1176438,5254111,8925627 5254146,1178001,8925478,8925755 5254125,1168008,8925491,8925755 </CODE></PRE> <P>Thank you very much.</P> Thu, 28 Feb 2019 10:09:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417159#M120059 alc2019 2019-02-28T10:09:58Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417160#M120060 <P>Hi alc2019,</P> <P>You can use regular expression in your search</P> <PRE><CODE>base search | regex fieldname="11\d{5}" </CODE></PRE> Thu, 28 Feb 2019 14:25:36 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417160#M120060 n0str0m08 2019-02-28T14:25:36Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417161#M120061 <P>Hi,</P> <P>You can try that:</P> <PRE><CODE>Base search | eval match = case(match(yourField,"^11\d{5}|,11\d{5}"),"YES",1=1,"NO") | where match = "YES" | fields - match </CODE></PRE> <P>Let me know if it works</P> <P>Kail</P> Thu, 28 Feb 2019 14:38:21 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417161#M120061 KailA 2019-02-28T14:38:21Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417162#M120062 <P>Hi @alc2019</P> <P>Try this and let me know</P> <PRE><CODE>| makeresults | eval sample_data ="7031671,1117162" | regex sample_data = "(^11\d{5}|,11\d{5})" </CODE></PRE> Thu, 28 Feb 2019 15:01:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417162#M120062 vnravikumar 2019-02-28T15:01:33Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417163#M120063 <P>Thank you! What does the "|" mean?</P> Thu, 28 Feb 2019 15:40:14 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417163#M120063 alc2019 2019-02-28T15:40:14Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417164#M120064 <P>| means OR. If it works, please accept the answer.</P> Thu, 28 Feb 2019 15:43:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417164#M120064 vnravikumar 2019-02-28T15:43:03Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417165#M120065 <P>Perfect! It works. Thank you very much.</P> Fri, 01 Mar 2019 00:20:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-events-where-the-phone-number-field-only-begins/m-p/417165#M120065 alc2019 2019-03-01T00:20:16Z