Hi Experts,
How can I get events on a numeric field where a 7 digit number begins with 11?
I tried with ...my search... field=="11*" but it is not matching all the numbers.
Sample data:
1166538
1212345
1116934
3331234
6037211,1166000
6037233,6031111
4160309,1118905
7031671,1117162
1186934,7038716
8016102,1187282
1176438,5254111,8925627
1175538,5254112,8925629
5254146,1178001,8925478,8925755
5254125,5268008,8925492,8925785
Events expected to be included containing - any 7-digit-number that begins with 11XXXXX:
1166538
1116934
6037211,1166000
4160309,1118905
7031671,1117162
1186934,7038716
8016102,1187282
1176438,5254111,8925627
5254146,1178001,8925478,8925755
5254125,1168008,8925491,8925755
Thank you very much.
Hi @alc2019
Try this and let me know
| makeresults
| eval sample_data ="7031671,1117162"
| regex sample_data = "(^11\d{5}|,11\d{5})"
Hi @alc2019
Try this and let me know
| makeresults
| eval sample_data ="7031671,1117162"
| regex sample_data = "(^11\d{5}|,11\d{5})"
Thank you! What does the "|" mean?
| means OR. If it works, please accept the answer.
Perfect! It works. Thank you very much.
Hi,
You can try that:
Base search
| eval match = case(match(yourField,"^11\d{5}|,11\d{5}"),"YES",1=1,"NO")
| where match = "YES"
| fields - match
Let me know if it works
Kail
Hi alc2019,
You can use regular expression in your search
base search | regex fieldname="11\d{5}"