Splunk Search

Concatenating Fields in an Eval If Statement

Path Finder

Been trying to create a new field that adds a leading zero to a field value if that value is lower than 100. I've tried what i would usually but i'm sure I'm missing something obvious.

 eval FLNO=if(FlighNumber<100,"0".FlightNumber,FlightNumber)
0 Karma
1 Solution

Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

View solution in original post

0 Karma

Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Assuming Flight Number is an integer between 1 - 999 and assuming you also want padding for numbers less than 10, see if the following helps:

| eval N = len(tostring(FlightNumber)) 
| eval zeroes = "00".tostring(FlightNumber) 
| eval FLNO = substr(zeroes,N,3)
0 Karma

Explorer

How about create new field before

your search | eval FlighNumberWithLeadingZero="0".FlightNumber | eval FLNO=if(FlighNumber<100,FlighNumberWithLeadingZero,FlightNumber)
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!