How to extract numbers correctly

[pomazanelvira]

Hi!
I have this field in my log: callerSipNumber="18121710_text". How should I extract "18121710" and name it "number"?
I've tried |rex field=callerSipNumber "((?)[_\w+])". But it didn't give anything. Thanks a lot!

[vnravikumar]

Hi

Try this

| makeresults 
| eval test="callerSipNumber=\"18121710_text\"" 
| rex field=test "callerSipNumber=\"(?P<result>[\d]+)"

[pomazanelvira]

thank u for "makeresults" function

[richgalloway · Accepted solution]

| rex field=callerSipNumber "(?<number>\d+)" will do it.

[pomazanelvira]

thanks a lot!