topic Re: extend a field value in Splunk Search

extend a field value

Oti47 — Thu, 13 Jun 2013 08:32:59 GMT

hello,
i want to extend a number field to a defined length like:

1324 to 001234
45678 to 045678

How could i do that on a simple way?

Thanks

kristian_kolb — Thu, 13 Jun 2013 08:50:51 GMT

Assuming that you have a field num_field that needs to be zero-padded into 6 characters, and that the value of the field does not exceed 999999;

eval num_field = "000000" . num_field | eval num_field = substr(num_field, -6)

Oti47 — Thu, 13 Jun 2013 08:53:56 GMT

Hi,
yes it works.

Thanks