I have a rex that returns a series of 5-8 digit IDs:
SEARCH
"rex field=_raw "2012-\d\d-\d\d,\d,(?
RESULT (HotelID)
10645909
10645911
10645912
1065511
1065512
I need to trim the last 2 digits off of each of them so I used an expression that had worked before:
| eval Hotel=tostring(HotelID) | eval Hotel=rtrim(Hotel,substr(Hotel,-2))
and it's produces:
1.81733e+07
3.01515e+07
2.55715e+07
2.8893e+06
2.83481e+07
7.98262e+06
2.98611e+06
3.46589e+07
I've tried it with and without the tostring and get the same results. What is it converting to and how to I get it to stop? 🙂
Well I'm not sure why it's doing it but I was given a simple regex that fixed it from the start.
(?
Well I'm not sure why it's doing it but I was given a simple regex that fixed it from the start.
(?
appears to be a bug in the rtrim()
(also trim()
) function. Workaround is to use tostring()
on the first argument:
| eval Hotel=tostring(HotelID) | eval Hotel=rtrim(tostring(Hotel),substr(Hotel,-2))
or:
... | eval Hotel=substr(Hotel,0,len(Hotel)-2)