Splunk Search

How can I selectively append 0 on an attribute with a value less than 10 digits

leonheart78
Explorer

Hi there,

I'm handling a set of data which in one of the attributes, CustNo is inconsistent. I need to append "0" for those CustNo which are lesser than 10 digits.

Currently, I'm using "...... | eval CustNo= "0" + CustNo |" which is appending "0" to all the CustNo.
Thank you.

Leon

Tags (2)
0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

If the field is a number already, you can use the len() function to check how many digits:
.... | eval check=if(len(date_second)>=10, date_second, date_second."0")

View solution in original post

woodcock
Esteemed Legend

Like this:

|rex field=CustNo mode=sed "s/^(\d{0,9})$/\1#0/ s/#//"
0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

If the field is a number already, you can use the len() function to check how many digits:
.... | eval check=if(len(date_second)>=10, date_second, date_second."0")

aholzer
Motivator

As long as the field is a number this should work:
... | eval CustNo = if(CustNo<10, "0" . CustNo,CustNo)

If it isn't a number then you can do the following:
... | eval CustNo = if(tonumber(CustNo)<10, "0" . CustNo,CustNo)

Hope this helps

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...