Splunk Search

How can I tell a field value's type (number or string) just by looking?

woodcock
Esteemed Legend

I know that I can use the isnum() and isstr() functions but surely there is a more obvious way, right?

Tags (3)
1 Solution

woodcock
Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

View solution in original post

ferdydek
Path Finder

You can use typeof() function to determine what is type of a field.
More info https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/InformationalFunctions

woodcock
Esteemed Legend

Also, isnumber.

0 Karma

woodcock
Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

woodcock
Esteemed Legend

Note that tostring and tonumber are not honored by this convention, which makes me sad.

woodcock
Esteemed Legend

Also typeof().

0 Karma

_smp_
Builder

This is such a brilliant little detail you noticed. Thanks!!

0 Karma

woodcock
Esteemed Legend

Hey @jkjeong why the downvote here? Seriously; is there something amiss that I am totally missing?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...