topic Re: How to keep leading zeros in a numeric field when converting it to string? in Splunk Search

How to keep leading zeros in a numeric field when converting it to string?

fere — Thu, 27 Feb 2014 20:47:17 GMT

I have this as part of my query: eval this_move=tostring(seq)."-."screen
Only I need to make sure seq is treated as 2 digit number before converting to string. Is there a way to do that?

Re: How to keep leading zeros in a numeric field when converting it to string?

aholzer — Thu, 27 Feb 2014 21:01:56 GMT

This should get you what want you need:

<base search> | eval temp=if(length(seq)<2,"0"+seq,seq) | eval this_move=temp+"-"+screen

I split it into two eval statements to make it easier to understand what's going on, but you can consolidate it into a single eval statement if you prefer.

Note: I assume that "screen" is a string field that you want to concatenate with "seq" field

Hope this helps

Re: How to keep leading zeros in a numeric field when converting it to string?

fere — Thu, 27 Feb 2014 21:15:02 GMT

thanks for your help