Splunk Search

tostring turning integers into decimals

rachelneal
Path Finder

I have a rex that returns a series of 5-8 digit IDs:

SEARCH
"rex field=_raw "2012-\d\d-\d\d,\d,(?\d{1,8})""

RESULT (HotelID)

10645909
10645911
10645912
1065511
1065512

I need to trim the last 2 digits off of each of them so I used an expression that had worked before:
| eval Hotel=tostring(HotelID) | eval Hotel=rtrim(Hotel,substr(Hotel,-2))

and it's produces:

1.81733e+07
3.01515e+07
2.55715e+07
2.8893e+06
2.83481e+07
7.98262e+06
2.98611e+06
3.46589e+07

I've tried it with and without the tostring and get the same results. What is it converting to and how to I get it to stop? 🙂

Tags (3)
1 Solution

rachelneal
Path Finder

Well I'm not sure why it's doing it but I was given a simple regex that fixed it from the start.

(?\d+)\d{2} DOH!!!!

View solution in original post

rachelneal
Path Finder

Well I'm not sure why it's doing it but I was given a simple regex that fixed it from the start.

(?\d+)\d{2} DOH!!!!

gkanapathy
Splunk Employee
Splunk Employee

appears to be a bug in the rtrim() (also trim()) function. Workaround is to use tostring() on the first argument:

| eval Hotel=tostring(HotelID) | eval Hotel=rtrim(tostring(Hotel),substr(Hotel,-2))
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

or:

... | eval Hotel=substr(Hotel,0,len(Hotel)-2)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...