Splunk Search

Display phone number value without commas?

simpkins1958
Contributor

Trying to display a phone number as a single value but it is getting formatted with commas:

xx,xxx,xxx,xxx

What just the numbers:

xxxxxxxxxxx

Tags (3)
0 Karma

ngatchasandra
Builder

Hi simpkins1958,

Try with this query, it work fine!!!!

your base search...| rex newPhoneNumber=phoneNumber mode=sed "s/,/ /g"

Eg: with this, 2,147,483,648 become 2 147 483 648

0 Karma

gyslainlatsa
Motivator

hi simpkins 1958,

use the function rmcomma() like this |convert rmcomma(PhoneNumber)

rmcomma()
Syntax: rmcomma(<wc-field>)
Description: Removes all commas from value, for example
rmcomma(1,000,000.00) returns 1000000.00. You can use wild card
characters in the field name.

fdi01
Motivator
host = jims-splunk-02  source = NetMotion sourcetype = PhoneNumber |spath | rename value  as PhoneNumber|...
0 Karma

somesoni2
Revered Legend

Can you post some sample events? Does your raw data already have commas in phone number values?

0 Karma

simpkins1958
Contributor

3/8/16
6:13:23.000 PM

{ [-]
adapterId: 351873050549463

uid: CCD77670006B3660B91BCB1C5EDB45C0

value: 12065555555

}

Show as raw text
host = jims-splunk-02

source = NetMotion

sourcetype = PhoneNumber

0 Karma

simpkins1958
Contributor

We have a phone number value of 12065555555

and it is displaying as 12,0625,555,555

Want it displayed without the commas.

0 Karma
Get Updates on the Splunk Community!

Alpha Launch: AI-Assisted Auto-Schematization for CIM

Streamlining Data Onboarding: Announcing the Alpha Release of AI-Assisted Auto-Schematization For many Splunk ...

Enterprise Security(ES) Essentials or Premier? Let's discuss Splunk ES Editions on ...

  Hi everyone, Last year at .conf25, we shared something exciting: Splunk Enterprise Security is evolving ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 5

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...