Splunk Search

How to search 25 digit numbers to find and compare a subset?

walsh_david
Engager

Hello,

we have a system that receives data from multiple sources each of these sources identifies the data being sent by a 25digit number, this number can be broken down by a combination of the positions, the number comes in the following format:

TTWWWWWSSSYYMMDDCCCCCPL

What I am trying to do is extract the CCCC portion of the number (Positions 19-23) and compare this with a lookup table to identify the sender of the information and then sort the associated data by the sender

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The substr function should do it.

| eval CCCC = substr(bigNumber, 19, 4)

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...