topic Re: extract no. in Splunk Search

extract no.

splunkuseradmin — Thu, 18 Jul 2019 18:03:02 GMT

hi all
I have events in json format need to extract number from this sip:+1234566@12.23.34.45
example: i need +1234566 from this any regex exp for this ..... field name is "Routing-Number"
thanks

Re: extract no.

Vijeta — Thu, 18 Jul 2019 18:47:44 GMT

You can use this

rex field=_raw "sip:(?<RoutingNumber>\S+)@"

Re: extract no.

vnravikumar — Thu, 18 Jul 2019 19:31:52 GMT

Try this rex,

| makeresults 
| eval test="sip:+1234566@12.23.34.45" 
| rex field=test "sip:(?P<RoutingNumber>[^@]+)"

Re: extract no.

vinod94 — Fri, 19 Jul 2019 14:54:13 GMT

Dyude!

You can try this,

| makeresults 
| fields - _time 
| eval data="sip:+1234566@12.23.34.45" 
| rex field=data "sip\:\+(?P<Routing_Number>.*)\@"

Re: extract no.

vnravikumar — Fri, 19 Jul 2019 15:15:01 GMT

Try the above rex, which extracts the required string with a minimum steps

https://regex101.com/r/ULGqk2/1