Split the numbers and perform addition

[SabariRajanT]

Team,

I have field 50+ employee id = 12345. I need to split this numbers and perform addition operation in splunk and to show up those in splunk

Employee id - 12345

action should be = 1+2+3+4+5 = 15 

[rnowitzki]

Hi @SabariRajanT ,

Is the employee ID always 5 digits?

In that case, this here works:

| makeresults 
| eval employeeid="12345" 
| rex field=employeeid "(?<digit1>\d)(?<digit2>\d)(?<digit3>\d)(?<digit4>\d)(?<digit5>\d)"
|eval checksum=digit1+digit2+digit3+digit4+digit5

(you will only need the last 2 lines)

But as mentioned, only works with 5 digits. So maybe not the most smartest way.

BR
Ralph

[SabariRajanT]

Hi @rnowitzki 

Thanks for your response.

Employee id varies from length 4,5,6 .

[rnowitzki · Accepted solution]

@SabariRajanT ,

Ok, if it is always and for sure 4 or 5 or 6 digits, then this will work.

Due to the heat in my office, I couln't come up with something more smart 🙂 But it should work:

| eval length=len(employeeid)
| rex field=employeeid "(?<digit4_1>\d)(?<digit4_2>\d)(?<digit4_3>\d)(?<digit4_4>\d)"
| rex field=employeeid "(?<digit5_1>\d)(?<digit5_2>\d)(?<digit5_3>\d)(?<digit5_4>\d)(?<digit5_5>\d)"
| rex field=employeeid "(?<digit6_1>\d)(?<digit6_2>\d)(?<digit6_3>\d)(?<digit6_4>\d)(?<digit6_5>\d)(?<digit6_6>\d)"
|eval checksum=case(length=4,digit4_1+digit4_2+digit4_3+digit4_4,length=5,digit5_1+digit5_2+digit5_3+digit5_4+digit5_5,length=6,digit6_1+digit6_2+digit6_3+digit6_4+digit6_5+digit6_6)
| fields - digit* length

 
Hope it helps
BR 
Ralph

--
Karma and/or Solution tagging appreciated.

[SabariRajanT]

@rnowitzki  - Thank you very much.!

Regards,

Sabari