Getting Data In

## Transforming 18 digit numbers into 15 digits

Builder

I want to transform 18 digit numbers into 15 digit by dropping last 3 digits. Could someone please guide me for that?
Props.conf

``````[weblog]
TRANSFORMS = numbers
``````

Transforms.conf

``````[numbers]
SOURCE_KEY = _raw
REGEX = xxxx\"\:\d+
FORMAT = \d{15}
``````
Tags (2)
1 Solution SplunkTrust

I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:

``````<timestamp> some text here number=123456789012345678
``````

You want to extract the first fifteen digits? You could do this in props.conf:

``````[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})
``````

If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:

``````[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)
``````

That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely. SplunkTrust

I'm not quite sure where you're going with this, so I'll make up my own example. Say this is your log:

``````<timestamp> some text here number=123456789012345678
``````

You want to extract the first fifteen digits? You could do this in props.conf:

``````[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})
``````

If it's important that there are exactly three numbers dropped off the end you can extend the expression like so:

``````[weblog]
EXTRACT-fifteen = number=(?<fifteen>\d{15})\d\d\d(?!\d)
``````

That'll look for digits 16, 17, and 18 as well as make sure there's no digit 19 that might change the meaning of the event entirely.  