https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-without-using-rex-or-erex/m-p/213889#M62726 <P>How to extract a string without using rex or erex?</P> <P>Ex: I don't have clear logs for phone numbers, want to extract the phone number and then extract the country code from that field.</P> <P>I'm able to extract the phone numbers. But not able to extract the country code, since i have phone numbers with 2 and 3 digit country codes.</P> <P>Phone:</P> <PRE><CODE>%2SV334789873956 %2SV3528658298570 </CODE></PRE> <P>Extracted Contact:</P> <PRE><CODE>334789873956 3528658298570 </CODE></PRE> <P>I want to extract the first digits of above phone number. Here first number country code is 2 digits and second phone number has 3 digit country code.</P> <P>I need Country codes like below:</P> <PRE><CODE>33 352 </CODE></PRE> <P>Please suggest something on the above without using regex</P> Mon, 07 Nov 2016 20:33:20 GMT greeshmak 2016-11-07T20:33:20Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-without-using-rex-or-erex/m-p/213889#M62726 <P>How to extract a string without using rex or erex?</P> <P>Ex: I don't have clear logs for phone numbers, want to extract the phone number and then extract the country code from that field.</P> <P>I'm able to extract the phone numbers. But not able to extract the country code, since i have phone numbers with 2 and 3 digit country codes.</P> <P>Phone:</P> <PRE><CODE>%2SV334789873956 %2SV3528658298570 </CODE></PRE> <P>Extracted Contact:</P> <PRE><CODE>334789873956 3528658298570 </CODE></PRE> <P>I want to extract the first digits of above phone number. Here first number country code is 2 digits and second phone number has 3 digit country code.</P> <P>I need Country codes like below:</P> <PRE><CODE>33 352 </CODE></PRE> <P>Please suggest something on the above without using regex</P> Mon, 07 Nov 2016 20:33:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-without-using-rex-or-erex/m-p/213889#M62726 greeshmak 2016-11-07T20:33:20Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-without-using-rex-or-erex/m-p/213890#M62727 <P>Try this</P> <PRE><CODE>... | eval cc=substr(pn,1,len(pn)-10) | ... </CODE></PRE> Mon, 07 Nov 2016 22:05:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-without-using-rex-or-erex/m-p/213890#M62727 richgalloway 2016-11-07T22:05:31Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-without-using-rex-or-erex/m-p/213891#M62728 <P>@greeshmak - Did rich's answer below help you out? If yes, please don't forget to click "Accept" below his answer to resolve the question. If not, please leave a comment. Thanks.</P> Mon, 28 Nov 2016 23:39:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-string-without-using-rex-or-erex/m-p/213891#M62728 aaraneta_splunk 2016-11-28T23:39:33Z