Splunk Search

What is the best way to remove leading 0's from a field?

pradeepkumarg
Influencer

I have a field which has leading 0's before the actual value. How can I get rid of them.

Possible Values

0000000040671.80

-0000000020231.15

The field may contain the sign '-' for some of its values which I want to retain

Is there a better way than extracting a sign to a different field and the actual value without 0's into another field and then concatenating it?

Tags (2)
0 Karma
1 Solution

adauria_splunk
Splunk Employee
Splunk Employee

You might be able to use eval with ltrim(X,Y). Take a look at the info here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Commonevalfunctions

It would definitely handle the positive values. The negative ones need to be handled as well, but I think a well constructed eval could handle it.

View solution in original post

adauria_splunk
Splunk Employee
Splunk Employee

You might be able to use eval with ltrim(X,Y). Take a look at the info here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Commonevalfunctions

It would definitely handle the positive values. The negative ones need to be handled as well, but I think a well constructed eval could handle it.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...