Splunk Search

How to extract a string without using rex or erex?

greeshmak
Explorer

How to extract a string without using rex or erex?

Ex: I don't have clear logs for phone numbers, want to extract the phone number and then extract the country code from that field.

I'm able to extract the phone numbers. But not able to extract the country code, since i have phone numbers with 2 and 3 digit country codes.

Phone:

%2SV334789873956
%2SV3528658298570

Extracted Contact:

334789873956
3528658298570

I want to extract the first digits of above phone number. Here first number country code is 2 digits and second phone number has 3 digit country code.

I need Country codes like below:

33
352

Please suggest something on the above without using regex

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@greeshmak - Did rich's answer below help you out? If yes, please don't forget to click "Accept" below his answer to resolve the question. If not, please leave a comment. Thanks.

richgalloway
SplunkTrust
SplunkTrust

Try this

... | eval cc=substr(pn,1,len(pn)-10) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...