Splunk Search

Split without delimiter

EberlinM
Engager

How can I split a field, into many other fields, but without using a delimiter, and using the position range instead?

For example:

bignumber = 16563764

I need to split it in:

account id = position [0 to 3] of field "bignumber"

company code = position [4 to 6] of field "bignumber"

operation code = position [7] of field "bignumber"

 

Thanks!!

 

 

 

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval bignumber = 16563764
| eval digits=split(tostring(bignumber),"")
| eval accountId=mvjoin(mvindex(digits,0,3),"")
| eval companyCode=mvjoin(mvindex(digits,4,6),"")
| eval operationCode=mvindex(digits,7)
| fields - digits

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval bignumber = 16563764
| eval digits=split(tostring(bignumber),"")
| eval accountId=mvjoin(mvindex(digits,0,3),"")
| eval companyCode=mvjoin(mvindex(digits,4,6),"")
| eval operationCode=mvindex(digits,7)
| fields - digits
0 Karma

EberlinM
Engager

Thank you! Worked perfectly!

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...