Extract Area Code From Phone Numbers

[IRHM73]

Hi,

I wonder whether someone may be able to help me please.

I have a list of telephone numbers of varying length, but all with an area code at the beginning e.g. 44 for the UK.

What I'm trying to do is put together a regex which looks to see if the first three characters match 350, if they do then extract those 3 digits into my new field, or if they match 44, the extract those 2 digits into the same field.

This is what I've put together so far:

| rex field=telno "350?(?<area_code>\d{3})|44?(?area_code>\d{2})"

I've clearly gone wrong, because Splunk is returning a "unrecognised character" error.

Could someone possibly look at this please and offer some guidance on where I've gone wrong.

Many thanks and kind regards

Chris

[DavidHourani · Accepted solution]

Hi @IRHM73,

What you're looking for is way easier than what you've built, something like this :

 | rex field=telno "(?<area_code>^350|^44)"

This will grab 350 if your number starts with that or 44 if it starts with that. Feel free to add the + sign if you need it. You can use www.regex101.com to validate your regexes it makes everything much easier.

Cheers,
David

[IRHM73]

Hi @DavidHourani . Thank you for your reply and solution. It works great.

Kind regards

Chris

[harsmarvania57]

Can you please provide some sample data (Please mask any sensitive data) ? I didn't get your question properly, do you want to extract 350 and 44 into same field or do you want to extract number after 350 and 44 ?

[IRHM73]

Hi @harsmarvania57 . Thank you for taking the time to reply.

Your solution worked great.

Thank you and kind regards

Chris

[harsmarvania57]

Great, earlier I thought that you want area code as number after 350 and 44 & that's why I deleted my answer earlier.