topic Re: Adding of value in splunk number string in Splunk Search

Adding of value in splunk number string

uagraw01 — Tue, 13 Aug 2024 15:17:23 GMT

Hello Splunkers!!

I want to achieve below results in Splunk. Please help me how to achieve this in SPL. Whenever the field is carrying number string then I want below expected results.

Current results	Expected values
1102.1.1	1102.01.01
1102.1.2	1102.01.02

Thanks in advance!!

Re: Adding of value in splunk number string

bowesmana — Tue, 13 Aug 2024 23:26:12 GMT

How are you getting your current results - what's your existing SPL?

Re: Adding of value in splunk number string

uagraw01 — Wed, 14 Aug 2024 03:09:44 GMT

@bowesmana Actually there is a lookup From which I want to extract such kind of pattern.

yesterday I performed so many hit and trial and finally the below one is working as expected.

| input lookup dsa.csv
| eval parts = split(Description, ".")
| eval part1 = mvindex(parts, 0)
| eval part2 = mvindex(parts, 1)
| eval part3 = mvindex(parts, 2)
| eval modified_part2= if(len(part2) == 1, "0" . part2, part2)
| eval modified_part3 = if(len(part3) == 1, "0" . part3, part3)
| eval modified_description = part1 . "." . modified_part2 . "." . modified_part3
| table Description, modified_description

Re: Adding of value in splunk number string

yuanliu — Wed, 14 Aug 2024 04:17:23 GMT

This might be easier

| eval modified_description = mvjoin(split(Description, "."), ".0")

Here is an emulation of your mock data

| makeresults format=csv = data="Description Aisle 1014 Aisle 1015 1102.1.1 1102.1.2" ``` the above emulates | input lookup dsa.csv ```

With this, the output is

Description	modified_description
Aisle 1014	Aisle 1014
Aisle 1015	Aisle 1015
1102.1.1	1102.01.01
1102.1.2	1102.01.02

Re: Adding of value in splunk number string

uagraw01 — Fri, 16 Aug 2024 18:57:06 GMT

@yuanliu This also working fine. Thanks for your suggestion.

Re: Adding of value in splunk number string

PickleRick — Fri, 16 Aug 2024 19:24:21 GMT

That's one way to do it.

Judging from your working code you want to replace the single digit with 0<digit> in any of those two fields, not just when both parts are short (which was suggested by your initial sample).

You can just do it with

| input lookup dsa.csv
| rex mode=sed field=Description "s/\b\d\b/0&/g"