Team,
I have field 50+ employee id = 12345. I need to split this numbers and perform addition operation in splunk and to show up those in splunk
Employee id - 12345
action should be = 1+2+3+4+5 = 15
@SabariRajanT ,
Ok, if it is always and for sure 4 or 5 or 6 digits, then this will work.
Due to the heat in my office, I couln't come up with something more smart 🙂 But it should work:
| eval length=len(employeeid)
| rex field=employeeid "(?<digit4_1>\d)(?<digit4_2>\d)(?<digit4_3>\d)(?<digit4_4>\d)"
| rex field=employeeid "(?<digit5_1>\d)(?<digit5_2>\d)(?<digit5_3>\d)(?<digit5_4>\d)(?<digit5_5>\d)"
| rex field=employeeid "(?<digit6_1>\d)(?<digit6_2>\d)(?<digit6_3>\d)(?<digit6_4>\d)(?<digit6_5>\d)(?<digit6_6>\d)"
|eval checksum=case(length=4,digit4_1+digit4_2+digit4_3+digit4_4,length=5,digit5_1+digit5_2+digit5_3+digit5_4+digit5_5,length=6,digit6_1+digit6_2+digit6_3+digit6_4+digit6_5+digit6_6)
| fields - digit* length
Hope it helps
BR
Ralph
--
Karma and/or Solution tagging appreciated.
Hi @SabariRajanT ,
Is the employee ID always 5 digits?
In that case, this here works:
| makeresults
| eval employeeid="12345"
| rex field=employeeid "(?<digit1>\d)(?<digit2>\d)(?<digit3>\d)(?<digit4>\d)(?<digit5>\d)"
|eval checksum=digit1+digit2+digit3+digit4+digit5
(you will only need the last 2 lines)
But as mentioned, only works with 5 digits. So maybe not the most smartest way.
BR
Ralph
@SabariRajanT ,
Ok, if it is always and for sure 4 or 5 or 6 digits, then this will work.
Due to the heat in my office, I couln't come up with something more smart 🙂 But it should work:
| eval length=len(employeeid)
| rex field=employeeid "(?<digit4_1>\d)(?<digit4_2>\d)(?<digit4_3>\d)(?<digit4_4>\d)"
| rex field=employeeid "(?<digit5_1>\d)(?<digit5_2>\d)(?<digit5_3>\d)(?<digit5_4>\d)(?<digit5_5>\d)"
| rex field=employeeid "(?<digit6_1>\d)(?<digit6_2>\d)(?<digit6_3>\d)(?<digit6_4>\d)(?<digit6_5>\d)(?<digit6_6>\d)"
|eval checksum=case(length=4,digit4_1+digit4_2+digit4_3+digit4_4,length=5,digit5_1+digit5_2+digit5_3+digit5_4+digit5_5,length=6,digit6_1+digit6_2+digit6_3+digit6_4+digit6_5+digit6_6)
| fields - digit* length
Hope it helps
BR
Ralph
--
Karma and/or Solution tagging appreciated.