https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534408#M151016 <LI-CODE lang="markup">| makeresults | eval version="7.3.2" | appendpipe[eval version="8.0.2.1" | appendpipe[eval version="7.2"| appendpipe[eval version="7"]]] | eval versions=mvindex(mvappend(split(version,"."),split("0000000","")),0,3) | eval version=mvjoin(versions,".")</LI-CODE><P>I couldn't make it with regular expressions.</P> Wed, 30 Dec 2020 00:07:37 GMT to4kawa 2020-12-30T00:07:37Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534402#M151013 <P>See the example values below. How do I convert the value of the version field, so that they have the same number of decimals?</P><P>version=7.3.2</P><P>version=8.0.2.1</P><P>I would like this to be converted to:</P><P>version=7.3.2.0</P><P>version=8.0.2.1</P> Tue, 29 Dec 2020 23:03:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534402#M151013 splunkyj 2020-12-29T23:03:39Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534403#M151014 <LI-CODE lang="markup">| makeresults | eval version="7.3.2" | appendpipe [| eval version="8.0.2.1"] | rex field=version mode=sed "s/\b(\d)\b/0\1/g s/\.//g" | eval version=substr(version."0000000",1,8) | rex field=version mode=sed "s/(\d\d)/\1./g s/0(\d)\b/\1/g s/\.$//"</LI-CODE><P><SPAN>I want the shift instruction.</SPAN></P> Tue, 29 Dec 2020 23:24:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534403#M151014 to4kawa 2020-12-29T23:24:34Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534406#M151015 <LI-CODE lang="markup">| makeresults | eval version="7.3.2" | appendpipe [| eval version="8.0.2.1" |appendpipe [eval version="7.2"|appendpipe [eval version="7"]]] | eval count=mvcount(split(version,".")) | eval version=version.substr(".0.0.0.0",1,(abs(count - 4) * 2) )</LI-CODE><P>Maybe it's easier this way.</P> Tue, 29 Dec 2020 23:42:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534406#M151015 to4kawa 2020-12-29T23:42:31Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534408#M151016 <LI-CODE lang="markup">| makeresults | eval version="7.3.2" | appendpipe[eval version="8.0.2.1" | appendpipe[eval version="7.2"| appendpipe[eval version="7"]]] | eval versions=mvindex(mvappend(split(version,"."),split("0000000","")),0,3) | eval version=mvjoin(versions,".")</LI-CODE><P>I couldn't make it with regular expressions.</P> Wed, 30 Dec 2020 00:07:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534408#M151016 to4kawa 2020-12-30T00:07:37Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534505#M151048 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/184221">@to4kawa</a>&nbsp;thank you so much again!! You rock! Both worked, I just went with this one because it's simpler. Or looked to be, let me know if the other one is more efficient. But they both worked well! One day I wanna be like you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 30 Dec 2020 17:48:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-version-number-so-the-dots-are-consistent/m-p/534505#M151048 splunkyj 2020-12-30T17:48:33Z