Is there any way to explicitly typecast a number in Splunk so that it is interpreted as a string literal rather than as a number?
IE, I want '64' to be interpreted as a string rather than as an integer.
Is this possible?
Assuming the number is the value of an extracted field:
... | eval your_field = tostring(your_field)
This and other uses of eval can be found in the search reference:
http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions
Assuming the number is the value of an extracted field:
... | eval your_field = tostring(your_field)
This and other uses of eval can be found in the search reference:
http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions