How can I selectively append 0 on an attribute with a value less than 10 digits

[leonheart78]

Hi there,

I'm handling a set of data which in one of the attributes, CustNo is inconsistent. I need to append "0" for those CustNo which are lesser than 10 digits.

Currently, I'm using "...... | eval CustNo= "0" + CustNo |" which is appending "0" to all the CustNo.
Thank you.

Leon

[woodcock]

Like this:

|rex field=CustNo mode=sed "s/^(\d{0,9})$/\1#0/ s/#//"

[jluo_splunk · Accepted solution]

If the field is a number already, you can use the len() function to check how many digits:
.... | eval check=if(len(date_second)>=10, date_second, date_second."0")

[aholzer]

As long as the field is a number this should work:
... | eval CustNo = if(CustNo<10, "0" . CustNo,CustNo)

If it isn't a number then you can do the following:
... | eval CustNo = if(tonumber(CustNo)<10, "0" . CustNo,CustNo)

Hope this helps