Splunk Search
Highlighted

Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?

Splunk Employee
Splunk Employee

Good news: this eval function was added in Splunk 6.6 (released today)

Highlighted

Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?

Explorer

Thanks Mitch and all the other Splunkers.

0 Karma
Highlighted

Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?

Engager

Assuming I know the numbers are always positive and below a certain length, I use a SUBSTR function. For example, to pad out to a 4-digit value
eval formattedNumber=substr("0000".rawNumber,-4)

Highlighted

Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?

This worked perfect for me!

Highlighted

Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?

Legend

Using printf conversion function this is possible using something like printf("%04d",fieldName). Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConversionFunctions#Flag_charact...

Following is a run anywhere example:

| makeresults
| fields - _time
| eval data=1
| eval padded_data= printf("%04d",data)



| eval message="Happy Splunking!!!"


0 Karma