Getting Data In

Transforming 18 digit numbers into 15 digits

Builder

I want to transform 18 digit numbers into 15 digit by dropping last 3 digits. Could someone please guide me for that?
Props.conf

[weblog]
TRANSFORMS = numbers

Transforms.conf

[numbers]
SOURCE_KEY = _raw
REGEX = xxxx\"\:\d+
FORMAT = \d{15}
Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:

<timestamp> some text here number=123456789012345678

You want to extract the first fifteen digits? You could do this in props.conf:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})

If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)

That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.

View solution in original post

SplunkTrust
SplunkTrust

I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:

<timestamp> some text here number=123456789012345678

You want to extract the first fifteen digits? You could do this in props.conf:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})

If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:

[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)

That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.

View solution in original post