Grab the first 3 digits - there are multiple ways to do this. Either you use eval
and substr
:
... | eval areacode=substr(yourphonefield,1,3)
Or you could use rex
:
... | rex field=yourphonefield "^(?<areacode>\d{3})"
Grab the first 3 digits - there are multiple ways to do this. Either you use eval
and substr
:
... | eval areacode=substr(yourphonefield,1,3)
Or you could use rex
:
... | rex field=yourphonefield "^(?<areacode>\d{3})"