I am trying to set up a fairly simple search:
index="sandbox" sourcetype="as-cdr" |stats count(eval(Calling_Number=*2155551220)) AS callsMade count(eval(Called_Number=*2155551220)) AS callsRecvd
However I receive an error stating:
Error in 'stats' command: The eval expression for dynamic field 'eval(Calling_Number=*2155551220)' is invalid. Error='The expression is malformed. An unexpected character is reached at '*2155551220'.'
The issue that I'm encountering is that the telephone number listed sometimes appears in the Called_Number field as 12155551220, sometimes appears as +12155551220, and other times appears as 2155551220. I have attempted to perform the search using wildcards like *in front of the shortest version however it seems to only occasionally work. Is it possible to evaluate for a substring with eval?
You have two problems with your use of eval:
=
operator in eval
. You would have to use either the like()
or searchmatch()
eval functions, the LIKE
operator, or use the replace()
eval function and apply the =
(or ==
) operator to that.eval
. If you don't, eval tries to perform a numeric comparison (in which 0123 is equal to 123, and *123 is not a valid number).So:
count(eval(replace(Calling_Number,"^(?:+1|1)?(.*)","\1") == "2155551220"))
is probably the best choice.
You could, if this is common, define a macro in macros.conf to normalize the phone number, and call that in your expressions everywhere
One potential easier solution might be to normalize the data after the fact. Something like this might work:
index="sandbox" sourcetype="as-cdr" |
rex mode=sed field=Calling_Number "s/(+1|1)(\d{10})/\2/" |
rex mode=sed field=Called_Number "s/(+1|1)(\d{10})/\2/" |
where Calling_Number=2155551220 OR Called_Number=2155551220 |
stats count(eval(Calling_Number=2155551220)) AS callsMade
count(eval(Called_Number=2155551220)) AS callsRecvd
That should filter off a "1" or "+1" at the beginning, if it's followed by a full 10 digits. I'm not 100% sure on the syntax, as splunk's sed differs a little from unix sed in terms of what needs a \ and what doesn't. But, it "should" work.