Splunk Search

How to categorize phone numbers in VOIP PABX logs in Splunk ?

dfigurello
Communicator

Hi Splunkers,

We have an VOIP PABX that is generating logs. Those logs are being indexed by Splunk. In those logs I have a "destination" field that shows the phone number dialed but the customer needs to classify the numbers dialed as local phone, other state number, mobile number, free call and so on. But I’m facing problems on how to categorize those numbers because they are variables (eg.: emergency number is 190, remote state number can be 1120023004 and mobile phone can be 992221414). Could you help me to find the best way to categorize those logs?

Cheers!

0 Karma
1 Solution

sk314
Builder

How do you differentiate between remote state number and mobile phone number as they both are 10 digits in length?

If the state number always begins with 112, you could pipe in an 'eval' statement like so:

| eval number_category = case(match(destination_field, "\d{3}"), "emergency_number", match(destination_field, "121\d{7}"), "remote_state_number", match(destination_field, "(?!112)\d{10}"), "mobile_phone")

Assuming destination_field is the field that captures your number.

View solution in original post

sk314
Builder

How do you differentiate between remote state number and mobile phone number as they both are 10 digits in length?

If the state number always begins with 112, you could pipe in an 'eval' statement like so:

| eval number_category = case(match(destination_field, "\d{3}"), "emergency_number", match(destination_field, "121\d{7}"), "remote_state_number", match(destination_field, "(?!112)\d{10}"), "mobile_phone")

Assuming destination_field is the field that captures your number.

dfigurello
Communicator

Hi sk314!
It's worked!

Thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...