Splunk Search

How to categorize phone numbers in VOIP PABX logs in Splunk ?

dfigurello
Communicator

Hi Splunkers,

We have an VOIP PABX that is generating logs. Those logs are being indexed by Splunk. In those logs I have a "destination" field that shows the phone number dialed but the customer needs to classify the numbers dialed as local phone, other state number, mobile number, free call and so on. But I’m facing problems on how to categorize those numbers because they are variables (eg.: emergency number is 190, remote state number can be 1120023004 and mobile phone can be 992221414). Could you help me to find the best way to categorize those logs?

Cheers!

0 Karma
1 Solution

sk314
Builder

How do you differentiate between remote state number and mobile phone number as they both are 10 digits in length?

If the state number always begins with 112, you could pipe in an 'eval' statement like so:

| eval number_category = case(match(destination_field, "\d{3}"), "emergency_number", match(destination_field, "121\d{7}"), "remote_state_number", match(destination_field, "(?!112)\d{10}"), "mobile_phone")

Assuming destination_field is the field that captures your number.

View solution in original post

sk314
Builder

How do you differentiate between remote state number and mobile phone number as they both are 10 digits in length?

If the state number always begins with 112, you could pipe in an 'eval' statement like so:

| eval number_category = case(match(destination_field, "\d{3}"), "emergency_number", match(destination_field, "121\d{7}"), "remote_state_number", match(destination_field, "(?!112)\d{10}"), "mobile_phone")

Assuming destination_field is the field that captures your number.

dfigurello
Communicator

Hi sk314!
It's worked!

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...