hi all
I have events in json format need to extract number from this sip:+1234566@12.23.34.45
example: i need +1234566 from this any regex exp for this ..... field name is "Routing-Number"
thanks
Dyude!
You can try this,
| makeresults
| fields - _time
| eval data="sip:+1234566@12.23.34.45"
| rex field=data "sip\:\+(?P<Routing_Number>.*)\@"
Hi
Try this rex,
| makeresults
| eval test="sip:+1234566@12.23.34.45"
| rex field=test "sip:(?P<RoutingNumber>[^@]+)"
Hi
Try the above rex, which extracts the required string with a minimum steps
You can use this
rex field=_raw "sip:(?<RoutingNumber>\S+)@"