how can we change the phone number format. i used sed mod it is working fine but i want to store the formatted phone number in separate variable,
for ex: 123-123-1234 to 1231231234
Any help will be highly appreciated. Thanks in advance.
HI @ajees_basha,
let me understand:
is it correct?
If this is your need, try something like this:
| makeresults count=1
| eval orig_num="123-123-1234"
| rex field=orig_num "^(?<ph1>\w+)-(?<ph2>\w+)-(?<ph3>\w+)"
| rex field=orig_num mode=sed "s/-//g"
Ciao.
Giuseppe
If you used sed successfully, then you have what you need. Just use eval to copy the field then use sed to format the copy and now you have the formatted number in a separate "variable".
Do you want to do this at ingestion or at search time?
@ITWhisperer at search time
You can try by updating props.cof also.
[YOUR_SOURCE_TYPE]
EVAL-new_phone_number = replace(phone_number,"-","")
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
HI @ajees_basha,
let me understand:
is it correct?
If this is your need, try something like this:
| makeresults count=1
| eval orig_num="123-123-1234"
| rex field=orig_num "^(?<ph1>\w+)-(?<ph2>\w+)-(?<ph3>\w+)"
| rex field=orig_num mode=sed "s/-//g"
Ciao.
Giuseppe
@gcusello yes i want to remove the hyphens(-) between phone number and store the formatted number(without hyphen) in a separate variable
Hi @ajees_basha,
is mine or one of the other answers good for you?
Tell us if you need more help, otherwise, please, accept one answer for the other people of Community.
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated by all the Contributors 😉
@gcusello Thank you. sorry to bother you..just one quick doubt is there a way we change the number from
1234567890 to 123-456-7890
HI @ajees_basha,
in this case you have to do the opporite operation using the substr option in the eval command, something like this:
| makeresults count=1
| eval my_field="1234567890"
| eval phone=substr(my_field,1,3)."-".substr(my_field,4,3)."-".substr(my_field,7,4)
| table phone
Ciao.
Giuseppe
@ITWhisperer @gcusello @kamlesh_vaghela @richgalloway @bowesmana any help will be highly appreciated