Splunk Search

How to edit my props.conf to extract a field with leading zeros as a number instead of a string by default?

vganjare
Builder

HI,

I have a field which has a lot of leading zeros. Currently, this field is getting extracted as a string field. I want to extract this field as a numeric field. Following are the event details:

| ContactNumber | Age | Name  | Country |
| 0001234567    | 25  | Sunny | USA     |
| 0009854676    | 32  | Vinny | UK      |

I have used the following in props.conf for field extraction:

[MyCustomSource]
EXTRACT-CONTACT_NO = (?i)^(?:[^\t]*\t){0}(?P<CONTACT_NO >[^\t]+)

Can you please help?

Thanks!!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

[MyCustomSource]
EXTRACT-CONTACT_NO = ^\s*\|\s*(?:0*)?(?<CONTACT_NO>\d+)

The main error that was going to cause it to NEVER work is the space in your capture name between the "NO" and the ">".

View solution in original post

stephanefotso
Motivator

Hello! Try this and let me know what happen. If not working, please let me ge a sample of your raw data:

[MyCustomSource]
 EXTRACT-CONTACT_NO =^ [|\t0]+(?P<CONTACT_NO >\d+)\s+

Thanks

SGF
0 Karma

woodcock
Esteemed Legend

Like this:

[MyCustomSource]
EXTRACT-CONTACT_NO = ^\s*\|\s*(?:0*)?(?<CONTACT_NO>\d+)

The main error that was going to cause it to NEVER work is the space in your capture name between the "NO" and the ">".

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...