topic Extract Area Code From Phone Numbers in Splunk Search

Extract Area Code From Phone Numbers

IRHM73 — Thu, 16 May 2019 08:59:36 GMT

Hi,

I wonder whether someone may be able to help me please.

I have a list of telephone numbers of varying length, but all with an area code at the beginning e.g. 44 for the UK.

What I'm trying to do is put together a regex which looks to see if the first three characters match 350, if they do then extract those 3 digits into my new field, or if they match 44, the extract those 2 digits into the same field.

This is what I've put together so far:

| rex field=telno "350?(?<area_code>\d{3})|44?(?area_code>\d{2})"

I've clearly gone wrong, because Splunk is returning a "unrecognised character" error.

Could someone possibly look at this please and offer some guidance on where I've gone wrong.

Many thanks and kind regards

Chris

Re: Extract Area Code From Phone Numbers

harsmarvania57 — Thu, 16 May 2019 09:34:22 GMT

Can you please provide some sample data (Please mask any sensitive data) ? I didn't get your question properly, do you want to extract 350 and 44 into same field or do you want to extract number after 350 and 44 ?

Re: Extract Area Code From Phone Numbers

DavidHourani — Thu, 16 May 2019 10:02:27 GMT

Hi @IRHM73,

What you're looking for is way easier than what you've built, something like this :

 | rex field=telno "(?<area_code>^350|^44)"

This will grab 350 if your number starts with that or 44 if it starts with that. Feel free to add the + sign if you need it. You can use www.regex101.com to validate your regexes it makes everything much easier.

Cheers,
David

Re: Extract Area Code From Phone Numbers

IRHM73 — Thu, 16 May 2019 10:25:45 GMT

Hi @harsmarvania57 . Thank you for taking the time to reply.

Your solution worked great.

Thank you and kind regards

Chris

Re: Extract Area Code From Phone Numbers

IRHM73 — Thu, 16 May 2019 10:26:40 GMT

Hi @DavidHourani . Thank you for your reply and solution. It works great.

Kind regards

Chris

Re: Extract Area Code From Phone Numbers

harsmarvania57 — Thu, 16 May 2019 10:41:53 GMT

Great, earlier I thought that you want area code as number after 350 and 44 & that's why I deleted my answer earlier.