topic Re: How to extract three separate values from my sample event into a single field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277676#M83745 <P>Try this</P> <PRE><CODE>... | rex "Code.{3}(?&lt;ac&gt;\d{3})".*\b(?&lt;pre&gt;\d{3})\b.*\b(?&lt;no&gt;\d{4})" | eval phone=ac."-".pre."-".no </CODE></PRE> Tue, 09 Feb 2016 21:12:26 GMT sundareshr 2016-02-09T21:12:26Z How to extract three separate values from my sample event into a single field? https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277674#M83743 <P>Hi,</P> <P>I have events with the below format:</P> <PRE><CODE>"phone":{"areaCode":"732","prefix":"986","lineNumber":"0245", </CODE></PRE> <P>Is there a way we could extract all the above values to a single field called phone as 732-986-0245?</P> <P>Can someone please help us in this?</P> <P>Thanks<BR /> Sarath</P> Tue, 09 Feb 2016 20:55:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277674#M83743 splunker9999 2016-02-09T20:55:26Z Re: How to extract three separate values from my sample event into a single field? https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277675#M83744 <P>Correcting my question !!</P> <P>we actually have the value as below in our events and we need to extract from events <BR /> Hi,</P> <P>I have a event with below format</P> <P>"phone":{"areaCode":"732","prefix":"986","lineNumber":"0245",</P> <P>Is there a way, we could extract all the above to a single field called phone as 732-986-0245?</P> <P>Can someone please help us in this?</P> <P>Thanks<BR /> Sarath</P> Tue, 09 Feb 2016 20:58:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277675#M83744 splunker9999 2016-02-09T20:58:48Z Re: How to extract three separate values from my sample event into a single field? https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277676#M83745 <P>Try this</P> <PRE><CODE>... | rex "Code.{3}(?&lt;ac&gt;\d{3})".*\b(?&lt;pre&gt;\d{3})\b.*\b(?&lt;no&gt;\d{4})" | eval phone=ac."-".pre."-".no </CODE></PRE> Tue, 09 Feb 2016 21:12:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277676#M83745 sundareshr 2016-02-09T21:12:26Z Re: How to extract three separate values from my sample event into a single field? https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277677#M83746 <P>Do you have json formatted events and right now you get 3 fields <CODE>phone.areaCode</CODE>, <CODE>phone.prefix</CODE> and <CODE>phone.lineNumber</CODE> OR you just get a field say phone and that field contains the whole string <CODE>"phone":{"areaCode":"732","prefix":"986","lineNumber":"0245"</CODE>?</P> Tue, 09 Feb 2016 21:18:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277677#M83746 somesoni2 2016-02-09T21:18:55Z Re: How to extract three separate values from my sample event into a single field? https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277678#M83747 <P>Just create a calculated field for the sourcetype (under Settings-&gt;Fields) and use the eval expression <CODE>phone.areaCode."-".phone.prefix."-".phone.lineNumber</CODE><BR /> Make sure you elevate to app or system visibility and the field will show up whenever you search for that sourcetype.<BR /> This, of course, assumes that you have valid JSON events and not just the fragment you have shown us...</P> Tue, 09 Feb 2016 22:16:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-three-separate-values-from-my-sample-event-into-a/m-p/277678#M83747 s2_splunk 2016-02-09T22:16:36Z