Splunk Search

What is the best way to remove leading 0's from a field?

pradeepkumarg
Influencer

I have a field which has leading 0's before the actual value. How can I get rid of them.

Possible Values

0000000040671.80

-0000000020231.15

The field may contain the sign '-' for some of its values which I want to retain

Is there a better way than extracting a sign to a different field and the actual value without 0's into another field and then concatenating it?

Tags (2)
0 Karma
1 Solution

adauria_splunk
Splunk Employee
Splunk Employee

You might be able to use eval with ltrim(X,Y). Take a look at the info here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Commonevalfunctions

It would definitely handle the positive values. The negative ones need to be handled as well, but I think a well constructed eval could handle it.

View solution in original post

adauria_splunk
Splunk Employee
Splunk Employee

You might be able to use eval with ltrim(X,Y). Take a look at the info here:

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Commonevalfunctions

It would definitely handle the positive values. The negative ones need to be handled as well, but I think a well constructed eval could handle it.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...