Splunk Search

How to append zeros to the beginning of existing numeric values for a field to make each value 6 digits long?

ajdyer2000
Path Finder

Hi

I was wondering if anyone may be able to help. We have an existing field with numbers from 2 up to 6 digits.

09
03
465
498
3895
6409
85939
37624
847809
783906

I would like to be able to append zero's to the list so they will all have 6 digits as below

000009
000003
000465
000498
003895
006409
085939
037624
847809
783906

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use this:

... | eval SerialNumber = substr("00000", 0, max(6-len(SerialNumber), 0)) . SerialNumber

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can use this:

... | eval SerialNumber = substr("00000", 0, max(6-len(SerialNumber), 0)) . SerialNumber

martin_mueller
SplunkTrust
SplunkTrust

Yup, updated the answer with the field name for input and output.

0 Karma

ajdyer2000
Path Finder

Thank you martin that worked

ajdyer2000
Path Finder

thanks Martin. the field name is "SerialNumber" how would I incorporate that into the eval command?

0 Karma

somesoni2
Revered Legend

Replace 'input' with 'SerialNumber'.

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...