Splunk Search

How to keep leading zeros in a numeric field when converting it to string?

fere
Path Finder

I have this as part of my query: eval this_move=tostring(seq)."-."screen
Only I need to make sure seq is treated as 2 digit number before converting to string. Is there a way to do that?

Tags (2)
0 Karma
1 Solution

aholzer
Motivator

This should get you what want you need:

<base search> | eval temp=if(length(seq)<2,"0"+seq,seq) | eval this_move=temp+"-"+screen

I split it into two eval statements to make it easier to understand what's going on, but you can consolidate it into a single eval statement if you prefer.

Note: I assume that "screen" is a string field that you want to concatenate with "seq" field

Hope this helps

View solution in original post

aholzer
Motivator

This should get you what want you need:

<base search> | eval temp=if(length(seq)<2,"0"+seq,seq) | eval this_move=temp+"-"+screen

I split it into two eval statements to make it easier to understand what's going on, but you can consolidate it into a single eval statement if you prefer.

Note: I assume that "screen" is a string field that you want to concatenate with "seq" field

Hope this helps

fere
Path Finder

thanks for your help

0 Karma
Get Updates on the Splunk Community!

Splunk Platform | Upgrading your Splunk Deployment to Python 3.9

Splunk initially announced the removal of Python 2 during the release of Splunk Enterprise 8.0.0, aiming to ...

From Product Design to User Insights: Boosting App Developer Identity on Splunkbase

co-authored by Yiyun Zhu & Dan Hosaka Engaging with the Community at .conf24 At .conf24, we revitalized the ...

Detect and Resolve Issues in a Kubernetes Environment

We’ve gone through common problems one can encounter in a Kubernetes environment, their impacts, and the ...