Getting Data In

Transforming 18 digit numbers into 15 digits

satishsdange
Builder

I want to transform 18 digit numbers into 15 digit by dropping last 3 digits. Could someone please guide me for that?
Props.conf

[weblog]
TRANSFORMS = numbers

Transforms.conf

[numbers]
SOURCE_KEY = _raw
REGEX = xxxx\"\:\d+
FORMAT = \d{15}
Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:

<timestamp> some text here number=123456789012345678

You want to extract the first fifteen digits? You could do this in props.conf:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})

If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)

That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:

<timestamp> some text here number=123456789012345678

You want to extract the first fifteen digits? You could do this in props.conf:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})

If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)

That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.

Get Updates on the Splunk Community!

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...