i have a query which result in a 6 digit number for a fieldname that might include leading "0" like 001234, 012345, 123456
my query returns a single fieldname, something like fieldname=001234, and i want to show this number on a single value dashboard. but i go to the visualization the leading zero is removed by splunk and show just the number 1234
please help me achieve this and show the number in a single value dashboard with the leading "0"
I am sure there is a better way to solve this, but if you are in a hurry and don't mind a non-numerical suffix, you can concatenate a character such as * to the end of the number
For example
| eval digit=digit."*"
From the looks of it, the visualization itself does some sort of zero and white space stripping, and eval=tostring(digit) does not work either.
Hope this helps
@okayal thanks for the comments, though after that the leading zero is stripped off on the visualization while it is present in the search results.
Strange, I ran the following, and its working for me
| makeresults
| eval digit="00123"
| eval digit=digit."*"