Splunk Search

How to keep leading zeros in a numeric field when converting it to string?

fere
Path Finder

I have this as part of my query: eval this_move=tostring(seq)."-."screen
Only I need to make sure seq is treated as 2 digit number before converting to string. Is there a way to do that?

Tags (2)
0 Karma
1 Solution

aholzer
Motivator

This should get you what want you need:

<base search> | eval temp=if(length(seq)<2,"0"+seq,seq) | eval this_move=temp+"-"+screen

I split it into two eval statements to make it easier to understand what's going on, but you can consolidate it into a single eval statement if you prefer.

Note: I assume that "screen" is a string field that you want to concatenate with "seq" field

Hope this helps

View solution in original post

aholzer
Motivator

This should get you what want you need:

<base search> | eval temp=if(length(seq)<2,"0"+seq,seq) | eval this_move=temp+"-"+screen

I split it into two eval statements to make it easier to understand what's going on, but you can consolidate it into a single eval statement if you prefer.

Note: I assume that "screen" is a string field that you want to concatenate with "seq" field

Hope this helps

fere
Path Finder

thanks for your help

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...