Is there a restriction to prefixing or suffixing the number with padded 0s?
Following examples will pad leading zeros and retain original number
Using printf (Splunk 6.6 onwards)
| makeresults | eval number= 581 | fieldformat number=printf("%04d",number)
You can use eval and do it this way -
To 100s -
| makeresults | eval number=22113 | eval number=number-(number%100)
To 1000s -
| makeresults | eval number=22113 | eval number=number-(number%1000)
Thanks for your reply.
| makeresults | eval number=22913 | eval number=number-(number%1000)
The above will end up with 22000 instead of 23000, so its more cutting that rounding. Is there a way to fix this?