Splunk Search

How to extract numbers correctly

pomazanelvira
New Member

Hi!
I have this field in my log: callerSipNumber="18121710_text". How should I extract "18121710" and name it "number"?
I've tried |rex field=callerSipNumber "((?)[_\w+])". But it didn't give anything. Thanks a lot!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

| rex field=callerSipNumber "(?<number>\d+)" will do it.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval test="callerSipNumber=\"18121710_text\"" 
| rex field=test "callerSipNumber=\"(?P<result>[\d]+)"
0 Karma

pomazanelvira
New Member

thank u for "makeresults" function

0 Karma

richgalloway
SplunkTrust
SplunkTrust

| rex field=callerSipNumber "(?<number>\d+)" will do it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

pomazanelvira
New Member

thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...