topic Re: How to change format and then insert+combine them in Splunk Search

How to change format and then insert+combine them

prot3ctor — Thu, 24 Oct 2019 15:11:58 GMT

Hello.

Could anyone help me out?
I have a DoB string with the following format dob='2002-01-03'
I would like to format this string to look like this: 020103

And then i would like to insert this data into an other sting after the 1st number which looks like this: data='1384198'

So in the end i would get data2='1020103384198'

Thank you

Re: How to change format and then insert+combine them

renjith_nair — Thu, 24 Oct 2019 16:22:21 GMT

@prot3ctor ,

Try

"Your search with fields dob,data"
|eval newString=strftime(strptime(dob,"%Y-%m-%d"),"%y%m%d")
|rex field=data "(?<_f>.)"|eval newString=replace(data,"^.",_f.newString)

Re: How to change format and then insert+combine them

prot3ctor — Thu, 31 Oct 2019 14:32:05 GMT

Will try. Thanks 🙂

Re: How to change format and then insert+combine them

prot3ctor — Sun, 17 Nov 2019 17:14:47 GMT

Hi. So this only puts the 2 strings next to each other. Is there a way to insert 1 string after the 1st character of the 2nd string?
Example:
dob=861010
ssn=123456

So in the end i would get a value what looks like this: 186101023456

Thanks

Re: How to change format and then insert+combine them

woodcock — Sun, 17 Nov 2019 22:25:45 GMT

Like this:

| makeresults 
| eval dob="2002-01-03", data="1384198"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval data2 = substr(data, 1, 1). replace(dob, "^..|-", "") . substr(data, 2)

Re: How to change format and then insert+combine them

renjith_nair — Mon, 18 Nov 2019 04:46:41 GMT

@prot3ctor ,

This is what I tried with the strings you provided

|makeresults|eval dob="2002-01-03",data="1384198"
|eval newString=strftime(strptime(dob,"%Y-%m-%d"),"%y%m%d")
|rex field=data "(?<_f>.)"|eval newString=replace(data,"^.",_f.newString)

and the result is 1020103384198

dob="2002-01-03" => 020103
date = 1384198
Result = 1 020103 384198

Re: How to change format and then insert+combine them

prot3ctor — Mon, 18 Nov 2019 21:54:35 GMT

It wasnt working for me at 1st cause i had to strip the single quotes from data first. Then i managed to get it to work

Thanks a lot 🙂

Re: How to change format and then insert+combine them

prot3ctor — Mon, 18 Nov 2019 21:55:54 GMT

It wasnt working for me at 1st cause i had to strip the single quotes from data first. Then i managed to get it to work

Thanks a lot 🙂