Splunk Search

Replace and add digit

jugarugabi
Path Finder

Hello, 

I have the following situation - in the original files I have the following information in the field:
ServerName1
ServerName10

I need to replace the values in the output to be something like:
srv01
srv10

while I know that the following command does replace the ServerName to srv, I cannot seem how to add 0 digit before the numbers that are having only one digit:

| rex field=AIS_ServerHost mode=sed "s/ServerName/srv/g"

The output will be:
srv1
srv10

A bit of help, please?

Thank you!

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @jugarugabi,
Apply rex command again to append 0 to values ending with a single digit.

| rex field=AIS_ServerHost mode=sed "s/ServerName/srv/g" 
| rex field=AIS_ServerHost mode=sed "s/srv(\d{1})$/srv0\1/g"

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

jugarugabi
Path Finder

Yup, this did the trick. 

Thanks!

0 Karma

manjunathmeti
Champion

hi @jugarugabi,
Apply rex command again to append 0 to values ending with a single digit.

| rex field=AIS_ServerHost mode=sed "s/ServerName/srv/g" 
| rex field=AIS_ServerHost mode=sed "s/srv(\d{1})$/srv0\1/g"

 

If this reply helps you, an upvote/like would be appreciated.

Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...