Splunk Search

Adding of value in splunk number string

uagraw01
Motivator

Hello Splunkers!!

I want to achieve below results in Splunk. Please help me how to achieve this in SPL. Whenever the field is carrying number string then I want below expected results.

Current resultsExpected values
1102.1.11102.01.01
1102.1.21102.01.02

uagraw01_0-1723561909346.png

Thanks in advance!!

Labels (2)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

How are you getting your current results - what's your existing SPL?

0 Karma

uagraw01
Motivator

@bowesmana Actually there is a lookup From which I want to extract such kind of pattern. 

yesterday I performed so many hit and trial and finally the below one is working as expected.

| input lookup dsa.csv
| eval parts = split(Description, ".")
| eval part1 = mvindex(parts, 0)
| eval part2 = mvindex(parts, 1)
| eval part3 = mvindex(parts, 2)
| eval modified_part2= if(len(part2) == 1, "0" . part2, part2)
| eval modified_part3 = if(len(part3) == 1, "0" . part3, part3)
| eval modified_description = part1 . "." . modified_part2 . "." . modified_part3
| table Description, modified_description

0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's one way to do it.

Judging from your working code you want to replace the single digit with 0<digit> in any of those two fields, not just when both parts are short (which was suggested by your initial sample).

You can just do it with

| input lookup dsa.csv
| rex mode=sed field=Description "s/\b\d\b/0&/g"

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This might be easier

 

| eval modified_description = mvjoin(split(Description, "."), ".0")

 

Here is an emulation of your mock data

 

| makeresults format=csv = data="Description
Aisle 1014
Aisle 1015
1102.1.1
1102.1.2"
```
the above emulates
| input lookup dsa.csv
```

 

With this, the output is

Descriptionmodified_description
Aisle 1014Aisle 1014
Aisle 1015Aisle 1015
1102.1.11102.01.01
1102.1.21102.01.02
Tags (1)

uagraw01
Motivator

@yuanliu  This also working fine. Thanks for your suggestion.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...