Splunk Search

Concatenating Fields in an Eval If Statement

svercelli
Path Finder

Been trying to create a new field that adds a leading zero to a field value if that value is lower than 100. I've tried what i would usually but i'm sure I'm missing something obvious.

 eval FLNO=if(FlighNumber<100,"0".FlightNumber,FlightNumber)
0 Karma
1 Solution

svercelli
Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

View solution in original post

0 Karma

svercelli
Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

0 Karma

javiergn
Super Champion

Assuming Flight Number is an integer between 1 - 999 and assuming you also want padding for numbers less than 10, see if the following helps:

| eval N = len(tostring(FlightNumber)) 
| eval zeroes = "00".tostring(FlightNumber) 
| eval FLNO = substr(zeroes,N,3)
0 Karma

AlexeyNL
Explorer

How about create new field before

your search | eval FlighNumberWithLeadingZero="0".FlightNumber | eval FLNO=if(FlighNumber<100,FlighNumberWithLeadingZero,FlightNumber)
0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...