Splunk Search

How to auto increment/decrement a value based on character position?

bijodev1
Communicator

Hi Everyone,

So the goal here is to auto increment / decrement a value based on the position of character present in a string.
For example : Here I am trying to pull and an assign a value to R

This works but only when the "pos" is less than 3. I would like to assign the value for each and every position.

Field1 = "RFTGQOASZ"

 

| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))+1
| eval value = 5
| eval pos1 = if(pos<3,value,0)

 




likewise the field1 value will change every time, I would like to assign a value based on the position.
so let say if the "R" character is in the middle , auto decrement the value, something like i--.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

View solution in original post

bijodev1
Communicator

Field1 = "RFTGQOASZ"
Here I am trying to assign a value to R based on it position. I don't want to use case

| makeresults
| eval assignvalue=10
| eval if the position of "R" is 1st Assign value 10 , if 2nd assign value 9, if 3rd  assign value -8 and so on

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

bijodev1
Communicator

if the position is 1, I would like to minus the value 4.  -  field1 = "RFTGQOASZ"
if the position is 2, I would like to minus the value 3.  -  field1 = "FRTGQOASZ"
if the position is 3, I would like to minus the value 2.  -  field1 = "FTRGQOASZ"

so if the position is high, value will decrease

so the value should be auto increment/decrement based on the position.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval value=pos-4
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please can you expand on your example as it is not clear which value is incremented or decremented, or when i.e. which event would contain the result?

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...