Adding of value in splunk number string

[uagraw01]

Hello Splunkers!!

I want to achieve below results in Splunk. Please help me how to achieve this in SPL. Whenever the field is carrying number string then I want below expected results.

Current results	Expected values
1102.1.1	1102.01.01
1102.1.2	1102.01.02

Thanks in advance!!

[bowesmana]

How are you getting your current results - what's your existing SPL?

[uagraw01]

@bowesmana Actually there is a lookup From which I want to extract such kind of pattern. 

yesterday I performed so many hit and trial and finally the below one is working as expected.

| input lookup dsa.csv
| eval parts = split(Description, ".")
| eval part1 = mvindex(parts, 0)
| eval part2 = mvindex(parts, 1)
| eval part3 = mvindex(parts, 2)
| eval modified_part2= if(len(part2) == 1, "0" . part2, part2)
| eval modified_part3 = if(len(part3) == 1, "0" . part3, part3)
| eval modified_description = part1 . "." . modified_part2 . "." . modified_part3
| table Description, modified_description

[PickleRick]

That's one way to do it.

Judging from your working code you want to replace the single digit with 0<digit> in any of those two fields, not just when both parts are short (which was suggested by your initial sample).

You can just do it with

| input lookup dsa.csv
| rex mode=sed field=Description "s/\b\d\b/0&/g"

[yuanliu]

This might be easier

| eval modified_description = mvjoin(split(Description, "."), ".0")

Here is an emulation of your mock data

| makeresults format=csv = data="Description
Aisle 1014
Aisle 1015
1102.1.1
1102.1.2"
```
the above emulates
| input lookup dsa.csv
```

With this, the output is

Description	modified_description
Aisle 1014	Aisle 1014
Aisle 1015	Aisle 1015
1102.1.1	1102.01.01
1102.1.2	1102.01.02

[uagraw01]

@yuanliu  This also working fine. Thanks for your suggestion.