Splunk Search

How to extract a string without using rex or erex?


How to extract a string without using rex or erex?

Ex: I don't have clear logs for phone numbers, want to extract the phone number and then extract the country code from that field.

I'm able to extract the phone numbers. But not able to extract the country code, since i have phone numbers with 2 and 3 digit country codes.



Extracted Contact:


I want to extract the first digits of above phone number. Here first number country code is 2 digits and second phone number has 3 digit country code.

I need Country codes like below:


Please suggest something on the above without using regex

0 Karma

Splunk Employee
Splunk Employee

@greeshmak - Did rich's answer below help you out? If yes, please don't forget to click "Accept" below his answer to resolve the question. If not, please leave a comment. Thanks.


Try this

... | eval cc=substr(pn,1,len(pn)-10) | ...
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!