Using printf conversion function this is possible using something like printf("%04d",fieldName) . Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConversionFunctions#Flag_characters Following is a run anywhere example: | makeresults | fields - _time | eval data=1 | eval padded_data= printf("%04d",data) ... View more