How do you get events where the phone number field only begins with specific digits?

[alc2019]

Hi Experts,

How can I get events on a numeric field where a 7 digit number begins with 11?

I tried with ...my search... field=="11*" but it is not matching all the numbers.

Sample data:

1166538
1212345
1116934
3331234
6037211,1166000
6037233,6031111
4160309,1118905
7031671,1117162
1186934,7038716
8016102,1187282
1176438,5254111,8925627
1175538,5254112,8925629
5254146,1178001,8925478,8925755
5254125,5268008,8925492,8925785

Events expected to be included containing - any 7-digit-number that begins with 11XXXXX:

1166538
1116934
6037211,1166000
4160309,1118905
7031671,1117162
1186934,7038716
8016102,1187282
1176438,5254111,8925627
5254146,1178001,8925478,8925755
5254125,1168008,8925491,8925755

Thank you very much.

[vnravikumar · Accepted solution]

Hi @alc2019

Try this and let me know

| makeresults 
| eval sample_data ="7031671,1117162" 
| regex sample_data = "(^11\d{5}|,11\d{5})"

[alc2019]

Thank you! What does the "|" mean?

[vnravikumar]

| means OR. If it works, please accept the answer.

[alc2019]

Perfect! It works. Thank you very much.

[KailA]

Hi,

You can try that:

Base search
| eval match = case(match(yourField,"^11\d{5}|,11\d{5}"),"YES",1=1,"NO")
| where match = "YES"
| fields - match

Let me know if it works

Kail

[n0str0m08]

Hi alc2019,

You can use regular expression in your search

base search | regex fieldname="11\d{5}"