Splunk Search

How to auto increment/decrement a value based on character position?

bijodev1
Communicator

Hi Everyone,

So the goal here is to auto increment / decrement a value based on the position of character present in a string.
For example : Here I am trying to pull and an assign a value to R

This works but only when the "pos" is less than 3. I would like to assign the value for each and every position.

Field1 = "RFTGQOASZ"

 

| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))+1
| eval value = 5
| eval pos1 = if(pos<3,value,0)

 




likewise the field1 value will change every time, I would like to assign a value based on the position.
so let say if the "R" character is in the middle , auto decrement the value, something like i--.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

View solution in original post

bijodev1
Communicator

Field1 = "RFTGQOASZ"
Here I am trying to assign a value to R based on it position. I don't want to use case

| makeresults
| eval assignvalue=10
| eval if the position of "R" is 1st Assign value 10 , if 2nd assign value 9, if 3rd  assign value -8 and so on

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

bijodev1
Communicator

if the position is 1, I would like to minus the value 4.  -  field1 = "RFTGQOASZ"
if the position is 2, I would like to minus the value 3.  -  field1 = "FRTGQOASZ"
if the position is 3, I would like to minus the value 2.  -  field1 = "FTRGQOASZ"

so if the position is high, value will decrease

so the value should be auto increment/decrement based on the position.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval value=pos-4
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please can you expand on your example as it is not clear which value is incremented or decremented, or when i.e. which event would contain the result?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...