Replace A pattern Splunk

[baranova]

Hello Guys ,

I have a field Month that have values like this

1-2013
10-2014
9-2014

i would like to get 0X-YYYY if month <10

so 1-2013 becomes 01-2013
10-2014 stays 10-2014
9-2014 becomes 09-2014

I've tried rex mode=sed field="Month" "s/(^[0-9]-.*)/0\1/" (it works fine on linux but not on Splunk ..)

Could you help me ?

Thanks !

[grijhwani]

I'm not familiar with sed mode, but have you tried escaping the square brackets with a backslash. Whenever a regex fails to match the expected results my first thought is always escaping special characters. Some regex modes assume special meaning unless expressly suppressed whilst others are the reverse, and just for fun some assume special meaning for one subset whilst not for others. It can be mind-bendingly confusing.

[HiroshiSatoh]

about using eval?

･･･|eval Month=if(len(Month)==6,"0"+Month,Month)