Splunk Search

How to auto increment/decrement a value based on character position?

bijodev1
Communicator

Hi Everyone,

So the goal here is to auto increment / decrement a value based on the position of character present in a string.
For example : Here I am trying to pull and an assign a value to R

This works but only when the "pos" is less than 3. I would like to assign the value for each and every position.

Field1 = "RFTGQOASZ"

 

| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))+1
| eval value = 5
| eval pos1 = if(pos<3,value,0)

 




likewise the field1 value will change every time, I would like to assign a value based on the position.
so let say if the "R" character is in the middle , auto decrement the value, something like i--.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

View solution in original post

bijodev1
Communicator

Field1 = "RFTGQOASZ"
Here I am trying to assign a value to R based on it position. I don't want to use case

| makeresults
| eval assignvalue=10
| eval if the position of "R" is 1st Assign value 10 , if 2nd assign value 9, if 3rd  assign value -8 and so on

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

bijodev1
Communicator

if the position is 1, I would like to minus the value 4.  -  field1 = "RFTGQOASZ"
if the position is 2, I would like to minus the value 3.  -  field1 = "FRTGQOASZ"
if the position is 3, I would like to minus the value 2.  -  field1 = "FTRGQOASZ"

so if the position is high, value will decrease

so the value should be auto increment/decrement based on the position.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval value=pos-4
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please can you expand on your example as it is not clear which value is incremented or decremented, or when i.e. which event would contain the result?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...