Splunk Search

How to keep leading zeros in a numeric field when converting it to string?

fere
Path Finder

I have this as part of my query: eval this_move=tostring(seq)."-."screen
Only I need to make sure seq is treated as 2 digit number before converting to string. Is there a way to do that?

Tags (2)
0 Karma
1 Solution

aholzer
Motivator

This should get you what want you need:

<base search> | eval temp=if(length(seq)<2,"0"+seq,seq) | eval this_move=temp+"-"+screen

I split it into two eval statements to make it easier to understand what's going on, but you can consolidate it into a single eval statement if you prefer.

Note: I assume that "screen" is a string field that you want to concatenate with "seq" field

Hope this helps

View solution in original post

aholzer
Motivator

This should get you what want you need:

<base search> | eval temp=if(length(seq)<2,"0"+seq,seq) | eval this_move=temp+"-"+screen

I split it into two eval statements to make it easier to understand what's going on, but you can consolidate it into a single eval statement if you prefer.

Note: I assume that "screen" is a string field that you want to concatenate with "seq" field

Hope this helps

fere
Path Finder

thanks for your help

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...