Knowledge Management

Split the numbers and perform addition

SabariRajanT
Path Finder

Team,

I have field 50+ employee id = 12345. I need to split this numbers and perform addition operation in splunk and to show up those in splunk

Employee id - 12345

action should be = 1+2+3+4+5 = 15 

Labels (3)
0 Karma
1 Solution

rnowitzki
Builder

@SabariRajanT ,

Ok, if it is always and for sure 4 or 5 or 6 digits, then this will work.

Due to the heat in my office, I couln't come up with something more smart 🙂 But it should work:

| eval length=len(employeeid)
| rex field=employeeid "(?<digit4_1>\d)(?<digit4_2>\d)(?<digit4_3>\d)(?<digit4_4>\d)"
| rex field=employeeid "(?<digit5_1>\d)(?<digit5_2>\d)(?<digit5_3>\d)(?<digit5_4>\d)(?<digit5_5>\d)"
| rex field=employeeid "(?<digit6_1>\d)(?<digit6_2>\d)(?<digit6_3>\d)(?<digit6_4>\d)(?<digit6_5>\d)(?<digit6_6>\d)"
|eval checksum=case(length=4,digit4_1+digit4_2+digit4_3+digit4_4,length=5,digit5_1+digit5_2+digit5_3+digit5_4+digit5_5,length=6,digit6_1+digit6_2+digit6_3+digit6_4+digit6_5+digit6_6)
| fields - digit* length

 
Hope it helps
BR 
Ralph

--
Karma and/or Solution tagging appreciated.

--
Karma and/or Solution tagging appreciated.

View solution in original post

rnowitzki
Builder

Hi @SabariRajanT ,

Is the employee ID always 5 digits?

In that case, this here works:

| makeresults 
| eval employeeid="12345" 
| rex field=employeeid "(?<digit1>\d)(?<digit2>\d)(?<digit3>\d)(?<digit4>\d)(?<digit5>\d)"
|eval checksum=digit1+digit2+digit3+digit4+digit5

(you will only need the last 2 lines)

But as mentioned, only works with 5 digits. So maybe not the most smartest way.

BR
Ralph


--
Karma and/or Solution tagging appreciated.
0 Karma

SabariRajanT
Path Finder

 

Hi @rnowitzki 

Thanks for your response.

Employee id varies from length 4,5,6 .

Tags (1)
0 Karma

rnowitzki
Builder

@SabariRajanT ,

Ok, if it is always and for sure 4 or 5 or 6 digits, then this will work.

Due to the heat in my office, I couln't come up with something more smart 🙂 But it should work:

| eval length=len(employeeid)
| rex field=employeeid "(?<digit4_1>\d)(?<digit4_2>\d)(?<digit4_3>\d)(?<digit4_4>\d)"
| rex field=employeeid "(?<digit5_1>\d)(?<digit5_2>\d)(?<digit5_3>\d)(?<digit5_4>\d)(?<digit5_5>\d)"
| rex field=employeeid "(?<digit6_1>\d)(?<digit6_2>\d)(?<digit6_3>\d)(?<digit6_4>\d)(?<digit6_5>\d)(?<digit6_6>\d)"
|eval checksum=case(length=4,digit4_1+digit4_2+digit4_3+digit4_4,length=5,digit5_1+digit5_2+digit5_3+digit5_4+digit5_5,length=6,digit6_1+digit6_2+digit6_3+digit6_4+digit6_5+digit6_6)
| fields - digit* length

 
Hope it helps
BR 
Ralph

--
Karma and/or Solution tagging appreciated.

--
Karma and/or Solution tagging appreciated.

SabariRajanT
Path Finder

@rnowitzki  - Thank you very much.!

Regards,

Sabari

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...