topic Re: How to edit my props.conf to extract a field with leading zeros as a number instead of a string by default? in Splunk Search

How to edit my props.conf to extract a field with leading zeros as a number instead of a string by default?

vganjare — Mon, 15 Jun 2015 12:02:34 GMT

HI,

I have a field which has a lot of leading zeros. Currently, this field is getting extracted as a string field. I want to extract this field as a numeric field. Following are the event details:

| ContactNumber | Age | Name  | Country |
| 0001234567    | 25  | Sunny | USA     |
| 0009854676    | 32  | Vinny | UK      |

I have used the following in props.conf for field extraction:

[MyCustomSource]
EXTRACT-CONTACT_NO = (?i)^(?:[^\t]*\t){0}(?P<CONTACT_NO >[^\t]+)

Can you please help?

Thanks!!

Re: How to edit my props.conf to extract a field with leading zeros as a number instead of a string by default?

woodcock — Mon, 15 Jun 2015 12:54:00 GMT

Like this:

[MyCustomSource]
EXTRACT-CONTACT_NO = ^\s*\|\s*(?:0*)?(?<CONTACT_NO>\d+)

The main error that was going to cause it to NEVER work is the space in your capture name between the "NO" and the ">".

Re: How to edit my props.conf to extract a field with leading zeros as a number instead of a string by default?

stephanefotso — Mon, 15 Jun 2015 13:02:02 GMT

Hello! Try this and let me know what happen. If not working, please let me ge a sample of your raw data:

[MyCustomSource]
 EXTRACT-CONTACT_NO =^ [|\t0]+(?P<CONTACT_NO >\d+)\s+

Thanks