Splunk Search

Display phone number value without commas?

simpkins1958
Contributor

Trying to display a phone number as a single value but it is getting formatted with commas:

xx,xxx,xxx,xxx

What just the numbers:

xxxxxxxxxxx

Tags (3)
0 Karma

ngatchasandra
Builder

Hi simpkins1958,

Try with this query, it work fine!!!!

your base search...| rex newPhoneNumber=phoneNumber mode=sed "s/,/ /g"

Eg: with this, 2,147,483,648 become 2 147 483 648

0 Karma

gyslainlatsa
Motivator

hi simpkins 1958,

use the function rmcomma() like this |convert rmcomma(PhoneNumber)

rmcomma()
Syntax: rmcomma(<wc-field>)
Description: Removes all commas from value, for example
rmcomma(1,000,000.00) returns 1000000.00. You can use wild card
characters in the field name.

fdi01
Motivator
host = jims-splunk-02  source = NetMotion sourcetype = PhoneNumber |spath | rename value  as PhoneNumber|...
0 Karma

somesoni2
Revered Legend

Can you post some sample events? Does your raw data already have commas in phone number values?

0 Karma

simpkins1958
Contributor

3/8/16
6:13:23.000 PM

{ [-]
adapterId: 351873050549463

uid: CCD77670006B3660B91BCB1C5EDB45C0

value: 12065555555

}

Show as raw text
host = jims-splunk-02

source = NetMotion

sourcetype = PhoneNumber

0 Karma

simpkins1958
Contributor

We have a phone number value of 12065555555

and it is displaying as 12,0625,555,555

Want it displayed without the commas.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...