Splunk Search

How to customize length of value with an added prefix?

nolejj
Explorer

Hello Community,

I would like to add trailing zeros in front of a value, but only display 5 characters for the value. In addition, I would want to add a prefix of "ABC-". I have no issue with the prefix, but the zeros I would need assistance. I could add 4 zeros in front of the value and then trim the value for displaying last 5 characters, but I wanted to see the cleanest way to accomplish. Examples below.

Value = 876

I would like the new value to be ABC-00875.

Value = 1678

I would like the new value to be ABC-01678.

Value = 5

I would like the new value to be ABC-00005.

 

Thanks,

Joe

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try the printf function.

| eval Value=printf("ABC-%05d", Value)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try the printf function.

| eval Value=printf("ABC-%05d", Value)
---
If this reply helps you, Karma would be appreciated.
0 Karma

nolejj
Explorer

Thank you. Short and nice. 🙂

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...