extract no.

[splunkuseradmin]

hi all
I have events in json format need to extract number from this sip:[email protected]
example: i need +1234566 from this any regex exp for this ..... field name is "Routing-Number"
thanks

[vinod94]

Dyude!

You can try this,

| makeresults 
| fields - _time 
| eval data="sip:[email protected]" 
| rex field=data "sip\:\+(?P<Routing_Number>.*)\@"

[vnravikumar]

Hi

Try this rex,

| makeresults 
| eval test="sip:[email protected]" 
| rex field=test "sip:(?P<RoutingNumber>[^@]+)"

[vnravikumar]

Hi

Try the above rex, which extracts the required string with a minimum steps

https://regex101.com/r/ULGqk2/1

[Vijeta · Accepted solution]

You can use this

rex field=_raw "sip:(?<RoutingNumber>\S+)@"