How to tell Splunk which fields are numbers in an uploaded .txt file?

[HeinzWaescher]

Hi,

I've create a sourcetype for uploading .txt files and use the headers as field names. Currently, all values are strings.

How I can tell Splunk which fields are numbers?

Update: It only seems to be a problem for numbers between -1 to 0 and 0 to 1. For example the value 0.99 is used as ".99"

Thanks in advance

Heinz

[lguinn2 · Accepted solution]

I concur that an enhancement request is always a good idea to let Splunk know what isn't working well (or at all) for you.

By default, fields in Splunk search do not have an explicit "type" - Splunk figures out the whether a field is alpha or numeric based on the values returned by a specific search. Fields in a data model do have an explicit type that is set when the data model is defined, but that is probably not relevant here.

Because the type is identified at search time, there is no way to "fix" this during import. Yet, it is painful to have to convert the field to numeric every time you want to use it. But there is a solution, with two options. The solution is to use Calculated Fields. The documentation tells you how to set up these fields manually, but you can do it in the UI under Settings -> Fields -> Calculated Fields

Just specify the new field name and the eval statement that is needed to calculate the field. Option 1: use the same field name

calculated field name: fieldA
eval expression: tonumber(fieldA)

Option 2: Choose a new field name

calculated field name: fieldA_num
eval expression: tonumber(fieldA)

Option 2 would be better in the case where there really could be values of fieldA that can't be converted to a numeric value - in those cases, tonumber(fieldA) will return null.

[HeinzWaescher]

Thanks everbody. The workaround with a calculated field is a good option, I'll use that.

[HeinzWaescher]

My workaround would be

... | eval new_value=tonumber(fieldA)

This seems to work fine, but perhaps there is a better solution to use during the import.

[tom_frotscher]

If you do not want to use this search term in every search, you can define this as a calculated field for the corresponding sourcetype.

See here: http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/definecalcfields

[woodcock]

I would open a support case and request an enhancement if they say it is not a bug and ask for a NUMERIC_FIELDS parameter to be implemented here:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Extractfieldsfromfileheadersatindextime#Props...