Hi all,
Please help me … not been success in passing the output of the search into a new search (different table).
index=voipdata 01448ACD5A7CCC212AFD039D
|stats values(MSISDN) as MSISDN|rex field=MSISDN "(?\d+)"|eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:+%phone%}",CallDataKey,NULL)
|table V5CallRoute1
Line by line explanation ...
index=voipdata 01448ACD5A7CCC212AFD039D |stats values(MSISDN) as MSISDN
// This returns a phone number {18433231540}
rex field=MSISDN "(?\d+)"
//This will format the above output to remove the bracket, hence 18433231540
eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:+%phone%}",CallDataKey,NULL)
//This is where I need help. Essentially , I’m searching the phone number on “V5CallRoute” table now. Here is an example of the field “PAITEL” -> PAITEL={tel:+18433231540} . So I ‘m trying to pass variable “phone” , apparently not getting any output.
Thanks
... View more