Splunk Search

How do you capture values with regex?

ebkeys94
Engager

Hi,

I am fairly new to regex and cannot figure out how to capture certain strings. Here is an example of the string in the file:

"'phoneNumber'  '1234567890'"

This string comes on one line and the two values are separated by a tab chart. I want to extract all of these phone numbers and list them under a 'phoneNumber' column. How do I go about getting these numbers? Thanks in advance

0 Karma

ebkeys94
Engager

I'll give a more specific example. A log can look like this:

2019-01-22T19:47:46.847 Int 04543 Interaction message "EventCallDataChanged")
: message EventCallDataChanged
AttributeUserData [2039] 00 3f 00 00..
'agent_id' ''
'attempt' 0
'phoneNumber' '1234567890'
'ent_CallResult' xx
'call_time' 0
'campaign_id' xxx

I want to get all phone numbers from logs and put into phonenumber column

0 Karma

Vijeta
Influencer

Assuming the ph number is going to be 10 digits you can use, rex field=x "'phone number'\s+'(?\d{10})'"

For example-

| makeresults |eval x="'phone number' '1234567890'"| rex field=x "'phone number'\s+'(?<phoneNumber>\d{10})'"

ebkeys94
Engager

Thanks for the answer but it did not seem to work. I put a better example in a comment to my post

0 Karma

Vijeta
Influencer

Try this.

rex field=x "'phoneNumber'\s+'(?<phoneNumber>\d{10})'"
Get Updates on the Splunk Community!

Community Content Calendar, August edition

In the dynamic world of cybersecurity, staying ahead means constantly solving new puzzles and optimizing your ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Whether you're managing complex deployments or looking to future-proof your data infrastructure, this session ...