Splunk Search

Concatenating Fields in an Eval If Statement

svercelli
Path Finder

Been trying to create a new field that adds a leading zero to a field value if that value is lower than 100. I've tried what i would usually but i'm sure I'm missing something obvious.

 eval FLNO=if(FlighNumber<100,"0".FlightNumber,FlightNumber)
0 Karma
1 Solution

svercelli
Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

View solution in original post

0 Karma

svercelli
Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

0 Karma

javiergn
Super Champion

Assuming Flight Number is an integer between 1 - 999 and assuming you also want padding for numbers less than 10, see if the following helps:

| eval N = len(tostring(FlightNumber)) 
| eval zeroes = "00".tostring(FlightNumber) 
| eval FLNO = substr(zeroes,N,3)
0 Karma

AlexeyNL
Explorer

How about create new field before

your search | eval FlighNumberWithLeadingZero="0".FlightNumber | eval FLNO=if(FlighNumber<100,FlighNumberWithLeadingZero,FlightNumber)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...