Splunk Search

How to append zeros to the beginning of existing numeric values for a field to make each value 6 digits long?

ajdyer2000
Path Finder

Hi

I was wondering if anyone may be able to help. We have an existing field with numbers from 2 up to 6 digits.

09
03
465
498
3895
6409
85939
37624
847809
783906

I would like to be able to append zero's to the list so they will all have 6 digits as below

000009
000003
000465
000498
003895
006409
085939
037624
847809
783906

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use this:

... | eval SerialNumber = substr("00000", 0, max(6-len(SerialNumber), 0)) . SerialNumber

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can use this:

... | eval SerialNumber = substr("00000", 0, max(6-len(SerialNumber), 0)) . SerialNumber

martin_mueller
SplunkTrust
SplunkTrust

Yup, updated the answer with the field name for input and output.

0 Karma

ajdyer2000
Path Finder

Thank you martin that worked

ajdyer2000
Path Finder

thanks Martin. the field name is "SerialNumber" how would I incorporate that into the eval command?

0 Karma

somesoni2
Revered Legend

Replace 'input' with 'SerialNumber'.

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...