Splunk Search

How to extract numbers correctly

pomazanelvira
New Member

Hi!
I have this field in my log: callerSipNumber="18121710_text". How should I extract "18121710" and name it "number"?
I've tried |rex field=callerSipNumber "((?)[_\w+])". But it didn't give anything. Thanks a lot!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

| rex field=callerSipNumber "(?<number>\d+)" will do it.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval test="callerSipNumber=\"18121710_text\"" 
| rex field=test "callerSipNumber=\"(?P<result>[\d]+)"
0 Karma

pomazanelvira
New Member

thank u for "makeresults" function

0 Karma

richgalloway
SplunkTrust
SplunkTrust

| rex field=callerSipNumber "(?<number>\d+)" will do it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

pomazanelvira
New Member

thanks a lot!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...