Splunk Search

What is the best way to remove leading 0's from a field?

pradeepkumarg
Influencer

I have a field which has leading 0's before the actual value. How can I get rid of them.

Possible Values

0000000040671.80

-0000000020231.15

The field may contain the sign '-' for some of its values which I want to retain

Is there a better way than extracting a sign to a different field and the actual value without 0's into another field and then concatenating it?

Tags (2)
0 Karma
1 Solution

adauria_splunk
Splunk Employee
Splunk Employee

You might be able to use eval with ltrim(X,Y). Take a look at the info here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Commonevalfunctions

It would definitely handle the positive values. The negative ones need to be handled as well, but I think a well constructed eval could handle it.

View solution in original post

adauria_splunk
Splunk Employee
Splunk Employee

You might be able to use eval with ltrim(X,Y). Take a look at the info here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Commonevalfunctions

It would definitely handle the positive values. The negative ones need to be handled as well, but I think a well constructed eval could handle it.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...