Splunk Search

How to assign field name area_code to first 3 digits in voip logs and geolocate based on field?


My voip logs have a format of xxxxxxxxxx 10 digit number.

Two questions:

How do I assign a field name of "area_code" to the first 3 digits of the number?

How do I do a geolocate on the area_code?

Thanks in advance for your help

Tags (2)
1 Solution

Revered Legend

Revered Legend

For first one you can use calculated fields.

May be this one for the second


Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...