Splunk Search

EVAL to Determine match to field.

C37996518
Explorer

Hi,  I have a data source of  call records for phone calls. This data contains a field "A_Number". I want to class any "A_Number" that begins with 04 as "Mobile" and anything else as "Fixed". Then I want to timechart a count of fixed and mobile events. 

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Here's an example using the eval+match statement to check if the number starts with 04.

This is a run anywhere search you can see how it works. It generates random data over the last 30 days for randomised phone numbers and then timecharts per day

| makeresults
| eval row=mvrange(1,random()%300+10)
| mvexpand row
| eval A_Number="04".(random()%900000+100000)
| eval _time=now()-(random() % 30) * 86400
| append [
| makeresults
| eval row=mvrange(1,random()%200+10)
| mvexpand row
| eval A_Number="02".(random()%90000000+10000000)
| eval _time=now()-(random() % 30) * 86400
]
| table _time A_Number
| eval NumberType=if(match(A_Number,"^04"),"Mobile","Fixed")
| timechart span=1d count by NumberType

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's an example using the eval+match statement to check if the number starts with 04.

This is a run anywhere search you can see how it works. It generates random data over the last 30 days for randomised phone numbers and then timecharts per day

| makeresults
| eval row=mvrange(1,random()%300+10)
| mvexpand row
| eval A_Number="04".(random()%900000+100000)
| eval _time=now()-(random() % 30) * 86400
| append [
| makeresults
| eval row=mvrange(1,random()%200+10)
| mvexpand row
| eval A_Number="02".(random()%90000000+10000000)
| eval _time=now()-(random() % 30) * 86400
]
| table _time A_Number
| eval NumberType=if(match(A_Number,"^04"),"Mobile","Fixed")
| timechart span=1d count by NumberType

 

0 Karma

C37996518
Explorer

Perfect! Thank you..

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...