topic Find text in field in Splunk Search

Find text in field

msarro — Thu, 24 Mar 2011 08:24:59 GMT

I am working to try and correlate two types of records. Each has telephone number fields called Calling_Number and Called_Number. Basically one data source lists the Calling_Number field in this format: +15555551212, whereas the second source lists it as 5555551212. Is it possible, basing the search off of the second data source, to search all of the Calling_Number fields in the first data source for the raw text of the number? I'm trying to find ways to correlate these records and splunk isn't working so well in this endeavor 😕 What would be awesome is something equivilent to an SQL LIKE command.

Re: Find text in field

dwaddle — Thu, 24 Mar 2011 08:37:17 GMT

The easiest thing to do might be to just create a new field based on Calling_Number, and use that for transaction or other correlation methods. Something like:

... | rex field="Calling_Number" "(+1)?(?<Bare_calling_number>\d+)"

would give you a new field called Bare_calling_number without the +1 on the head of it.

Re: Find text in field

msarro — Thu, 24 Mar 2011 09:13:22 GMT

As of now I am working around it, but knowing the rex should help a bit. I really need to find a guide on PCRE. Thanks!