Splunk Search

Concatenating Fields in an Eval If Statement

svercelli
Path Finder

Been trying to create a new field that adds a leading zero to a field value if that value is lower than 100. I've tried what i would usually but i'm sure I'm missing something obvious.

 eval FLNO=if(FlighNumber<100,"0".FlightNumber,FlightNumber)
0 Karma
1 Solution

svercelli
Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

View solution in original post

0 Karma

svercelli
Path Finder

You are all gonna be sooo mad but there was a typo and it turns out that was the error. the first FlightNumber was misspelled without the T.

0 Karma

javiergn
Super Champion

Assuming Flight Number is an integer between 1 - 999 and assuming you also want padding for numbers less than 10, see if the following helps:

| eval N = len(tostring(FlightNumber)) 
| eval zeroes = "00".tostring(FlightNumber) 
| eval FLNO = substr(zeroes,N,3)
0 Karma

AlexeyNL
Explorer

How about create new field before

your search | eval FlighNumberWithLeadingZero="0".FlightNumber | eval FLNO=if(FlighNumber<100,FlighNumberWithLeadingZero,FlightNumber)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...