https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368408#M108587 <P>@chitreshakumar, refer to answer by @somesoni2. I think that is what you need.</P> Sat, 30 Dec 2017 15:23:31 GMT niketn 2017-12-30T15:23:31Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368404#M108583 <P>I have duration 00:00:10.000000 i.e 00 hrs 00 mins 10 secs .But I want to add days also as my field has many values containing days also .SO is there any method to add " '00+' 00:00:10.000000" to the matched values "00:00:10.000000"??</P> Fri, 29 Dec 2017 09:21:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368404#M108583 chitreshakumar 2017-12-29T09:21:59Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368405#M108584 <P>@chitreshakumar are you looking for something like the following?</P> <PRE><CODE>| makeresults | eval durationInSec="12736,823321" | fields - _time | makemv durationInSec delim="," | mvexpand durationInSec | eval durationString=tostring(durationInSec,"duration") </CODE></PRE> <P>If you are just looking for concatenating number of days to HH:MM:SS you can use eval with dot <CODE>(.)</CODE> or plus <CODE>(+)</CODE></P> <PRE><CODE>| makeresults | eval durationString="00:00:10.000000" | eval days="01" | eval durationString=days."+".durationString </CODE></PRE> <P>If it is not one of the above, please share your current query and data to add more details.</P> Fri, 29 Dec 2017 09:58:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368405#M108584 niketn 2017-12-29T09:58:08Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368406#M108585 <P>@niketnilay Thanks for the reply !!! I want something like second one .Since I have days values in some duration field 11+09:45:25.591549 .And in some values it is having "HH:MM:SS" so I want to add days .<BR /> At first I need to match only those values having HH:MM:SS then add days to it.I think I am clear about the requirement .Let me know if you want me to elaborate more</P> Fri, 29 Dec 2017 10:04:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368406#M108585 chitreshakumar 2017-12-29T10:04:53Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368407#M108586 <P>Try like this (will add <CODE>00+</CODE> to duration if it doesn't have day notation)</P> <PRE><CODE>your current search with duration field say with name "duration" | eval duration=if(match(duration,"^\d+\+",duration,"00+".duration) </CODE></PRE> Fri, 29 Dec 2017 15:31:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368407#M108586 somesoni2 2017-12-29T15:31:35Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368408#M108587 <P>@chitreshakumar, refer to answer by @somesoni2. I think that is what you need.</P> Sat, 30 Dec 2017 15:23:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368408#M108587 niketn 2017-12-30T15:23:31Z https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368409#M108588 <P>@chitreshakumar - This one will work, or you can use the altered regex I put onto the other question.</P> Sat, 30 Dec 2017 20:50:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-insert-the-values-if-match-is-found/m-p/368409#M108588 DalJeanis 2017-12-30T20:50:13Z