How to categorize phone numbers in VOIP PABX logs in Splunk ?

[dfigurello]

Hi Splunkers,

We have an VOIP PABX that is generating logs. Those logs are being indexed by Splunk. In those logs I have a "destination" field that shows the phone number dialed but the customer needs to classify the numbers dialed as local phone, other state number, mobile number, free call and so on. But I’m facing problems on how to categorize those numbers because they are variables (eg.: emergency number is 190, remote state number can be 1120023004 and mobile phone can be 992221414). Could you help me to find the best way to categorize those logs?

Cheers!

[sk314 · Accepted solution]

How do you differentiate between remote state number and mobile phone number as they both are 10 digits in length?

If the state number always begins with 112, you could pipe in an 'eval' statement like so:

| eval number_category = case(match(destination_field, "\d{3}"), "emergency_number", match(destination_field, "121\d{7}"), "remote_state_number", match(destination_field, "(?!112)\d{10}"), "mobile_phone")

Assuming destination_field is the field that captures your number.

[dfigurello]

Hi sk314!
It's worked!

Thanks!