Splunk Search

How to search 25 digit numbers to find and compare a subset?

walsh_david
Engager

Hello,

we have a system that receives data from multiple sources each of these sources identifies the data being sent by a 25digit number, this number can be broken down by a combination of the positions, the number comes in the following format:

TTWWWWWSSSYYMMDDCCCCCPL

What I am trying to do is extract the CCCC portion of the number (Positions 19-23) and compare this with a lookup table to identify the sender of the information and then sort the associated data by the sender

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The substr function should do it.

| eval CCCC = substr(bigNumber, 19, 4)

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...