Hi,all
I want to use "substr" to get what I want.
A=1420014
... |eval A=if(substr(A, 1,2)="14",replace(A, "14", "0"),A) |table A
A will become "02000".
But it should be "020014".
Could anyone tell me what's worng? Can't I use substr by this way?
Thanks a lot. 😃
The replace operator will replace every occurence of a value in a string. From http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions :
This function returns a string formed by substituting string Z for every occurrence of regex string Y in string X. The third argument Z can also reference groups that are matched in the regex.
Given your example above, there are a couple of ways to attack it. If you're always wanting to replace the "14" (or whatever) at the beginning, you should be able to take advantage of the fact that replace uses regexes, and do something like:
... | eval A=if(substr(A,1,2)="14",replace(A,"^14","0"),A) | table A
Or you can accomplish the same thing with string concatenation, similar to:
... | eval A=if(substr(A,1,2)="14", "0".substr(A,3), A) | table A
The replace operator will replace every occurence of a value in a string. From http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions :
This function returns a string formed by substituting string Z for every occurrence of regex string Y in string X. The third argument Z can also reference groups that are matched in the regex.
Given your example above, there are a couple of ways to attack it. If you're always wanting to replace the "14" (or whatever) at the beginning, you should be able to take advantage of the fact that replace uses regexes, and do something like:
... | eval A=if(substr(A,1,2)="14",replace(A,"^14","0"),A) | table A
Or you can accomplish the same thing with string concatenation, similar to:
... | eval A=if(substr(A,1,2)="14", "0".substr(A,3), A) | table A
Wonderful!Thanks a lot.