https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497801#M138663 <P>Hi!<BR /> I have this field in my log: callerSipNumber="18121710_text". How should I extract "18121710" and name it "number"?<BR /> I've tried <STRONG>|rex field=callerSipNumber "((?)[_\w+])"</STRONG>. But it didn't give anything. Thanks a lot!</P> Wed, 30 Sep 2020 04:39:51 GMT pomazanelvira 2020-09-30T04:39:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497801#M138663 <P>Hi!<BR /> I have this field in my log: callerSipNumber="18121710_text". How should I extract "18121710" and name it "number"?<BR /> I've tried <STRONG>|rex field=callerSipNumber "((?)[_\w+])"</STRONG>. But it didn't give anything. Thanks a lot!</P> Wed, 30 Sep 2020 04:39:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497801#M138663 pomazanelvira 2020-09-30T04:39:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497802#M138664 <P><CODE>| rex field=callerSipNumber "(?&lt;number&gt;\d+)"</CODE> will do it.</P> Thu, 19 Mar 2020 14:21:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497802#M138664 richgalloway 2020-03-19T14:21:04Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497803#M138665 <P>Hi</P> <P>Try this</P> <PRE><CODE>| makeresults | eval test="callerSipNumber=\"18121710_text\"" | rex field=test "callerSipNumber=\"(?P&lt;result&gt;[\d]+)" </CODE></PRE> Thu, 19 Mar 2020 15:46:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497803#M138665 vnravikumar 2020-03-19T15:46:20Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497804#M138666 <P>thanks a lot!</P> Thu, 19 Mar 2020 15:47:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497804#M138666 pomazanelvira 2020-03-19T15:47:53Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497805#M138667 <P>thank u for "makeresults" function</P> Thu, 19 Mar 2020 15:48:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-numbers-correctly/m-p/497805#M138667 pomazanelvira 2020-03-19T15:48:28Z