Splunk Search

How to customize length of value with an added prefix?

nolejj
Explorer

Hello Community,

I would like to add trailing zeros in front of a value, but only display 5 characters for the value. In addition, I would want to add a prefix of "ABC-". I have no issue with the prefix, but the zeros I would need assistance. I could add 4 zeros in front of the value and then trim the value for displaying last 5 characters, but I wanted to see the cleanest way to accomplish. Examples below.

Value = 876

I would like the new value to be ABC-00875.

Value = 1678

I would like the new value to be ABC-01678.

Value = 5

I would like the new value to be ABC-00005.

 

Thanks,

Joe

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try the printf function.

| eval Value=printf("ABC-%05d", Value)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try the printf function.

| eval Value=printf("ABC-%05d", Value)
---
If this reply helps you, Karma would be appreciated.
0 Karma

nolejj
Explorer

Thank you. Short and nice. 🙂

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability - October 2025

What’s New?  We’re excited to announce the latest enhancements to Splunk Observability Cloud and share what’s ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened Audit Trail v2 wasn’t written in isolation—it was shaped by your voices. In ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...