Hello Splunkers!!
I want to achieve below results in Splunk. Please help me how to achieve this in SPL. Whenever the field is carrying number string then I want below expected results.
Current results | Expected values |
1102.1.1 | 1102.01.01 |
1102.1.2 | 1102.01.02 |
Thanks in advance!!
How are you getting your current results - what's your existing SPL?
@bowesmana Actually there is a lookup From which I want to extract such kind of pattern.
yesterday I performed so many hit and trial and finally the below one is working as expected.
| input lookup dsa.csv
| eval parts = split(Description, ".")
| eval part1 = mvindex(parts, 0)
| eval part2 = mvindex(parts, 1)
| eval part3 = mvindex(parts, 2)
| eval modified_part2= if(len(part2) == 1, "0" . part2, part2)
| eval modified_part3 = if(len(part3) == 1, "0" . part3, part3)
| eval modified_description = part1 . "." . modified_part2 . "." . modified_part3
| table Description, modified_description
That's one way to do it.
Judging from your working code you want to replace the single digit with 0<digit> in any of those two fields, not just when both parts are short (which was suggested by your initial sample).
You can just do it with
| input lookup dsa.csv
| rex mode=sed field=Description "s/\b\d\b/0&/g"
This might be easier
| eval modified_description = mvjoin(split(Description, "."), ".0")
Here is an emulation of your mock data
| makeresults format=csv = data="Description
Aisle 1014
Aisle 1015
1102.1.1
1102.1.2"
```
the above emulates
| input lookup dsa.csv
```
With this, the output is
Description | modified_description |
Aisle 1014 | Aisle 1014 |
Aisle 1015 | Aisle 1015 |
1102.1.1 | 1102.01.01 |
1102.1.2 | 1102.01.02 |
@yuanliu This also working fine. Thanks for your suggestion.