Splunk Search

How do you capture values with regex?

ebkeys94
Engager

Hi,

I am fairly new to regex and cannot figure out how to capture certain strings. Here is an example of the string in the file:

"'phoneNumber'  '1234567890'"

This string comes on one line and the two values are separated by a tab chart. I want to extract all of these phone numbers and list them under a 'phoneNumber' column. How do I go about getting these numbers? Thanks in advance

0 Karma

ebkeys94
Engager

I'll give a more specific example. A log can look like this:

2019-01-22T19:47:46.847 Int 04543 Interaction message "EventCallDataChanged")
: message EventCallDataChanged
AttributeUserData [2039] 00 3f 00 00..
'agent_id' ''
'attempt' 0
'phoneNumber' '1234567890'
'ent_CallResult' xx
'call_time' 0
'campaign_id' xxx

I want to get all phone numbers from logs and put into phonenumber column

0 Karma

Vijeta
Influencer

Assuming the ph number is going to be 10 digits you can use, rex field=x "'phone number'\s+'(?\d{10})'"

For example-

| makeresults |eval x="'phone number' '1234567890'"| rex field=x "'phone number'\s+'(?<phoneNumber>\d{10})'"

ebkeys94
Engager

Thanks for the answer but it did not seem to work. I put a better example in a comment to my post

0 Karma

Vijeta
Influencer

Try this.

rex field=x "'phoneNumber'\s+'(?<phoneNumber>\d{10})'"
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...