topic substr can't get the correct value? in Splunk Search

substr can't get the correct value?

flora123 — Tue, 16 Nov 2010 11:41:43 GMT

Hi,all

I want to use "substr" to get what I want.

A=1420014

... |eval A=if(substr(A, 1,2)="14",replace(A, "14", "0"),A) |table A

A will become "02000".

But it should be "020014".

Could anyone tell me what's worng? Can't I use substr by this way?

Thanks a lot. 😃

Re: substr can't get the correct value?

dwaddle — Tue, 16 Nov 2010 12:16:54 GMT

The replace operator will replace every occurence of a value in a string. From http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions :

This function returns a string formed by substituting string Z for every occurrence of regex string Y in string X. The third argument Z can also reference groups that are matched in the regex.

Given your example above, there are a couple of ways to attack it. If you're always wanting to replace the "14" (or whatever) at the beginning, you should be able to take advantage of the fact that replace uses regexes, and do something like:

... | eval A=if(substr(A,1,2)="14",replace(A,"^14","0"),A) | table A

Or you can accomplish the same thing with string concatenation, similar to:

... | eval A=if(substr(A,1,2)="14", "0".substr(A,3), A) | table A

Re: substr can't get the correct value?

flora123 — Tue, 16 Nov 2010 12:33:03 GMT

Wonderful!Thanks a lot.