Splunk Search

How to auto increment/decrement a value based on character position?

bijodev1
Communicator

Hi Everyone,

So the goal here is to auto increment / decrement a value based on the position of character present in a string.
For example : Here I am trying to pull and an assign a value to R

This works but only when the "pos" is less than 3. I would like to assign the value for each and every position.

Field1 = "RFTGQOASZ"

 

| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))+1
| eval value = 5
| eval pos1 = if(pos<3,value,0)

 




likewise the field1 value will change every time, I would like to assign a value based on the position.
so let say if the "R" character is in the middle , auto decrement the value, something like i--.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

View solution in original post

bijodev1
Communicator

Field1 = "RFTGQOASZ"
Here I am trying to assign a value to R based on it position. I don't want to use case

| makeresults
| eval assignvalue=10
| eval if the position of "R" is 1st Assign value 10 , if 2nd assign value 9, if 3rd  assign value -8 and so on

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

bijodev1
Communicator

if the position is 1, I would like to minus the value 4.  -  field1 = "RFTGQOASZ"
if the position is 2, I would like to minus the value 3.  -  field1 = "FRTGQOASZ"
if the position is 3, I would like to minus the value 2.  -  field1 = "FTRGQOASZ"

so if the position is high, value will decrease

so the value should be auto increment/decrement based on the position.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval value=pos-4
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please can you expand on your example as it is not clear which value is incremented or decremented, or when i.e. which event would contain the result?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...