Splunk Search

EVAL to Determine match to field.

C37996518
Explorer

Hi,  I have a data source of  call records for phone calls. This data contains a field "A_Number". I want to class any "A_Number" that begins with 04 as "Mobile" and anything else as "Fixed". Then I want to timechart a count of fixed and mobile events. 

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Here's an example using the eval+match statement to check if the number starts with 04.

This is a run anywhere search you can see how it works. It generates random data over the last 30 days for randomised phone numbers and then timecharts per day

| makeresults
| eval row=mvrange(1,random()%300+10)
| mvexpand row
| eval A_Number="04".(random()%900000+100000)
| eval _time=now()-(random() % 30) * 86400
| append [
| makeresults
| eval row=mvrange(1,random()%200+10)
| mvexpand row
| eval A_Number="02".(random()%90000000+10000000)
| eval _time=now()-(random() % 30) * 86400
]
| table _time A_Number
| eval NumberType=if(match(A_Number,"^04"),"Mobile","Fixed")
| timechart span=1d count by NumberType

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's an example using the eval+match statement to check if the number starts with 04.

This is a run anywhere search you can see how it works. It generates random data over the last 30 days for randomised phone numbers and then timecharts per day

| makeresults
| eval row=mvrange(1,random()%300+10)
| mvexpand row
| eval A_Number="04".(random()%900000+100000)
| eval _time=now()-(random() % 30) * 86400
| append [
| makeresults
| eval row=mvrange(1,random()%200+10)
| mvexpand row
| eval A_Number="02".(random()%90000000+10000000)
| eval _time=now()-(random() % 30) * 86400
]
| table _time A_Number
| eval NumberType=if(match(A_Number,"^04"),"Mobile","Fixed")
| timechart span=1d count by NumberType

 

0 Karma

C37996518
Explorer

Perfect! Thank you..

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...