Splunk Search

How to extract a string without using rex or erex?

greeshmak
Explorer

How to extract a string without using rex or erex?

Ex: I don't have clear logs for phone numbers, want to extract the phone number and then extract the country code from that field.

I'm able to extract the phone numbers. But not able to extract the country code, since i have phone numbers with 2 and 3 digit country codes.

Phone:

%2SV334789873956
%2SV3528658298570

Extracted Contact:

334789873956
3528658298570

I want to extract the first digits of above phone number. Here first number country code is 2 digits and second phone number has 3 digit country code.

I need Country codes like below:

33
352

Please suggest something on the above without using regex

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@greeshmak - Did rich's answer below help you out? If yes, please don't forget to click "Accept" below his answer to resolve the question. If not, please leave a comment. Thanks.

richgalloway
SplunkTrust
SplunkTrust

Try this

... | eval cc=substr(pn,1,len(pn)-10) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...