Splunk Search

How do you get events where the phone number field only begins with specific digits?

alc2019
New Member

Hi Experts,

How can I get events on a numeric field where a 7 digit number begins with 11?

I tried with ...my search... field=="11*" but it is not matching all the numbers.

Sample data:

1166538
1212345
1116934
3331234
6037211,1166000
6037233,6031111
4160309,1118905
7031671,1117162
1186934,7038716
8016102,1187282
1176438,5254111,8925627
1175538,5254112,8925629
5254146,1178001,8925478,8925755
5254125,5268008,8925492,8925785

Events expected to be included containing - any 7-digit-number that begins with 11XXXXX:

1166538
1116934
6037211,1166000
4160309,1118905
7031671,1117162
1186934,7038716
8016102,1187282
1176438,5254111,8925627
5254146,1178001,8925478,8925755
5254125,1168008,8925491,8925755

Thank you very much.

0 Karma
1 Solution

vnravikumar
Champion

Hi @alc2019

Try this and let me know

| makeresults 
| eval sample_data ="7031671,1117162" 
| regex sample_data = "(^11\d{5}|,11\d{5})"

View solution in original post

0 Karma

vnravikumar
Champion

Hi @alc2019

Try this and let me know

| makeresults 
| eval sample_data ="7031671,1117162" 
| regex sample_data = "(^11\d{5}|,11\d{5})"
0 Karma

alc2019
New Member

Thank you! What does the "|" mean?

0 Karma

vnravikumar
Champion

| means OR. If it works, please accept the answer.

0 Karma

alc2019
New Member

Perfect! It works. Thank you very much.

0 Karma

KailA
Contributor

Hi,

You can try that:

Base search
| eval match = case(match(yourField,"^11\d{5}|,11\d{5}"),"YES",1=1,"NO")
| where match = "YES"
| fields - match

Let me know if it works

Kail

0 Karma

n0str0m08
Explorer

Hi alc2019,

You can use regular expression in your search

base search | regex fieldname="11\d{5}"
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...