Splunk Search

How to auto increment/decrement a value based on character position?

bijodev1
Communicator

Hi Everyone,

So the goal here is to auto increment / decrement a value based on the position of character present in a string.
For example : Here I am trying to pull and an assign a value to R

This works but only when the "pos" is less than 3. I would like to assign the value for each and every position.

Field1 = "RFTGQOASZ"

 

| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))+1
| eval value = 5
| eval pos1 = if(pos<3,value,0)

 




likewise the field1 value will change every time, I would like to assign a value based on the position.
so let say if the "R" character is in the middle , auto decrement the value, something like i--.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

View solution in original post

bijodev1
Communicator

Field1 = "RFTGQOASZ"
Here I am trying to assign a value to R based on it position. I don't want to use case

| makeresults
| eval assignvalue=10
| eval if the position of "R" is 1st Assign value 10 , if 2nd assign value 9, if 3rd  assign value -8 and so on

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| field1 = "RFTGQOASZ"
| eval pos = len(mvindex(split(field1,"R"),0))
| eval value = 10-pos

bijodev1
Communicator

if the position is 1, I would like to minus the value 4.  -  field1 = "RFTGQOASZ"
if the position is 2, I would like to minus the value 3.  -  field1 = "FRTGQOASZ"
if the position is 3, I would like to minus the value 2.  -  field1 = "FTRGQOASZ"

so if the position is high, value will decrease

so the value should be auto increment/decrement based on the position.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval value=pos-4
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please can you expand on your example as it is not clear which value is incremented or decremented, or when i.e. which event would contain the result?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...