Splunk Search

How to append zeros to the beginning of existing numeric values for a field to make each value 6 digits long?

Engager

Hi

I was wondering if anyone may be able to help. We have an existing field with numbers from 2 up to 6 digits.

09
03
465
498
3895
6409
85939
37624
847809
783906

I would like to be able to append zero's to the list so they will all have 6 digits as below

000009
000003
000465
000498
003895
006409
085939
037624
847809
783906

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can use this:

... | eval SerialNumber = substr("00000", 0, max(6-len(SerialNumber), 0)) . SerialNumber

View solution in original post

SplunkTrust
SplunkTrust

You can use this:

... | eval SerialNumber = substr("00000", 0, max(6-len(SerialNumber), 0)) . SerialNumber

View solution in original post

SplunkTrust
SplunkTrust

Yup, updated the answer with the field name for input and output.

0 Karma

Engager

Thank you martin that worked

0 Karma

Engager

thanks Martin. the field name is "SerialNumber" how would I incorporate that into the eval command?

0 Karma

SplunkTrust
SplunkTrust

Replace 'input' with 'SerialNumber'.

0 Karma