Splunk Search

Splunk and localization of numbers

martindalum
Engager

I'm currently loading some localized CSV-files into Splunk which contains numbers formatted in a localized format (comma instead of period as decimal separator and period instead of comma as thousands separator). This format is used commonly in many countries.

Are there any plans for implementing support for setting locales for inputs/sourcetypes like you can set a charset in props.conf? It would be nice if Splunk could interpret 1.234.567,89 as the same numeric value as 1,234,567.89 without having to transform the data prior to feeding it to Splunk. Currently Splunk interprets "1.234.567,89" as a string.

Ideally numbers could be localized when presented depending on a language setting. However that's a bit extensive 🙂

Tags (2)

rturk
Builder

Hi Martin,

After a bit of a search, it turns out that Splunk provides for this, however just not in a pretty GUI.

Have a look here: http://docs.splunk.com/Documentation/Splunk/latest/Developer/TranslateSplunk#Localize_dates_and_numb...

Hope this helps 🙂

EDIT: Just as I clicked away, I think I just got what you were after. What if I had a file that was created by a system that used a decimal comma for localisation and I wanted to index & report on that along with files created in places that used a decimal point. Being able to specify the number localisation by host/source/sourcetype would be quite useful for this kind of scenario.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...