Splunk Search

How to change format and then insert+combine them

prot3ctor
New Member

Hello.

Could anyone help me out?
I have a DoB string with the following format dob='2002-01-03'
I would like to format this string to look like this: 020103

And then i would like to insert this data into an other sting after the 1st number which looks like this: data='1384198'

So in the end i would get data2='1020103384198'

Thank you

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@prot3ctor ,

Try

"Your search with fields dob,data"
|eval newString=strftime(strptime(dob,"%Y-%m-%d"),"%y%m%d")
|rex field=data "(?<_f>.)"|eval newString=replace(data,"^.",_f.newString)
Happy Splunking!

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval dob="2002-01-03", data="1384198"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval data2 = substr(data, 1, 1). replace(dob, "^..|-", "") . substr(data, 2)
0 Karma

prot3ctor
New Member

It wasnt working for me at 1st cause i had to strip the single quotes from data first. Then i managed to get it to work

Thanks a lot 🙂

0 Karma

renjith_nair
Legend

@prot3ctor ,

Try

"Your search with fields dob,data"
|eval newString=strftime(strptime(dob,"%Y-%m-%d"),"%y%m%d")
|rex field=data "(?<_f>.)"|eval newString=replace(data,"^.",_f.newString)
Happy Splunking!
0 Karma

prot3ctor
New Member

It wasnt working for me at 1st cause i had to strip the single quotes from data first. Then i managed to get it to work

Thanks a lot 🙂

0 Karma

prot3ctor
New Member

Hi. So this only puts the 2 strings next to each other. Is there a way to insert 1 string after the 1st character of the 2nd string?
Example:
dob=861010
ssn=123456

So in the end i would get a value what looks like this: 186101023456

Thanks

0 Karma

renjith_nair
Legend

@prot3ctor ,

This is what I tried with the strings you provided

|makeresults|eval dob="2002-01-03",data="1384198"
|eval newString=strftime(strptime(dob,"%Y-%m-%d"),"%y%m%d")
|rex field=data "(?<_f>.)"|eval newString=replace(data,"^.",_f.newString)

and the result is 1020103384198

dob="2002-01-03" => 020103
date = 1384198
Result = 1 020103 384198

Happy Splunking!
0 Karma

prot3ctor
New Member

Will try. Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...