How do you capture values with regex?

[ebkeys94]

Hi,

I am fairly new to regex and cannot figure out how to capture certain strings. Here is an example of the string in the file:

"'phoneNumber'  '1234567890'"

This string comes on one line and the two values are separated by a tab chart. I want to extract all of these phone numbers and list them under a 'phoneNumber' column. How do I go about getting these numbers? Thanks in advance

[ebkeys94]

I'll give a more specific example. A log can look like this:

2019-01-22T19:47:46.847 Int 04543 Interaction message "EventCallDataChanged")
: message EventCallDataChanged
AttributeUserData [2039] 00 3f 00 00..
'agent_id' ''
'attempt' 0
'phoneNumber' '1234567890'
'ent_CallResult' xx
'call_time' 0
'campaign_id' xxx

I want to get all phone numbers from logs and put into phonenumber column

[Vijeta]

Assuming the ph number is going to be 10 digits you can use, rex field=x "'phone number'\s+'(?\d{10})'"

For example-

| makeresults |eval x="'phone number' '1234567890'"| rex field=x "'phone number'\s+'(?<phoneNumber>\d{10})'"

[ebkeys94]

Thanks for the answer but it did not seem to work. I put a better example in a comment to my post

[Vijeta]

Try this.

rex field=x "'phoneNumber'\s+'(?<phoneNumber>\d{10})'"