Splunk Search

Find text in field

msarro
Builder

I am working to try and correlate two types of records. Each has telephone number fields called Calling_Number and Called_Number. Basically one data source lists the Calling_Number field in this format: +15555551212, whereas the second source lists it as 5555551212. Is it possible, basing the search off of the second data source, to search all of the Calling_Number fields in the first data source for the raw text of the number? I'm trying to find ways to correlate these records and splunk isn't working so well in this endeavor 😕 What would be awesome is something equivilent to an SQL LIKE command.

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

The easiest thing to do might be to just create a new field based on Calling_Number, and use that for transaction or other correlation methods. Something like:

... | rex field="Calling_Number" "(+1)?(?<Bare_calling_number>\d+)"

would give you a new field called Bare_calling_number without the +1 on the head of it.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The easiest thing to do might be to just create a new field based on Calling_Number, and use that for transaction or other correlation methods. Something like:

... | rex field="Calling_Number" "(+1)?(?<Bare_calling_number>\d+)"

would give you a new field called Bare_calling_number without the +1 on the head of it.

msarro
Builder

As of now I am working around it, but knowing the rex should help a bit. I really need to find a guide on PCRE. Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...