Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to categorize phone numbers in VOIP PABX logs ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunkers,
We have an VOIP PABX that is generating logs. Those logs are being indexed by Splunk. In those logs I have a "destination" field that shows the phone number dialed but the customer needs to classify the numbers dialed as local phone, other state number, mobile number, free call and so on. But I’m facing problems on how to categorize those numbers because they are variables (eg.: emergency number is 190, remote state number can be 1120023004 and mobile phone can be 992221414). Could you help me to find the best way to categorize those logs?
Cheers!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do you differentiate between remote state number and mobile phone number as they both are 10 digits in length?
If the state number always begins with 112, you could pipe in an 'eval' statement like so:
| eval number_category = case(match(destination_field, "\d{3}"), "emergency_number", match(destination_field, "121\d{7}"), "remote_state_number", match(destination_field, "(?!112)\d{10}"), "mobile_phone")
Assuming destination_field is the field that captures your number.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do you differentiate between remote state number and mobile phone number as they both are 10 digits in length?
If the state number always begins with 112, you could pipe in an 'eval' statement like so:
| eval number_category = case(match(destination_field, "\d{3}"), "emergency_number", match(destination_field, "121\d{7}"), "remote_state_number", match(destination_field, "(?!112)\d{10}"), "mobile_phone")
Assuming destination_field is the field that captures your number.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi sk314!
It's worked!
Thanks!
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
