Splunk Search

How to convert the values of multiple fields to number?

jvmerilla
Path Finder

Hi All,

Good day!

I just want to ask for some help here. 🙂

I have multiple fields with the data I'm working on with values, "0, 1, 2, 3, 4, 5, NULL".
Ex.
alt text

I replace the "NULL" values and replace it with space, " ", and add all of these fields and put it in a new field with this code:

| replace NULL WITH " " IN "FIELD A" "FIELD B" "FIELD C" "FIELD D" "FIELD E"
| eval newField ="FIELD A" +  " FIELD B" + " FIELD C" + "" FIELD D" + " FIELD E"

But instead of adding the values of the fields, it concatenates it like like this:
alt text

Notice that the events where there was a "NULL" values where seem to be treated as a string.

I tried to use the tonumber() function to convert it to string but it doesn't work.
Ex:

|eval "FIELD A" = tonumber("FIELD A")
|eval "FIELD B" = tonumber("FIELD B")
|eval "FIELD C" = tonumber("FIELD C")
|eval "FIELD D" = tonumber("FIELD D")
|eval "FIELD E" = tonumber("FIELD E")

What could be the possible cause of this issue and what could be the solution?

Thanks! 🙂

493669
Super Champion

try this:

...|replace NULL with 0|eval newField ='FIELD A' +  'FIELD B' + 'FIELD C' + 'FIELD D' + 'FIELD E'
0 Karma

ansif
Motivator

Remove double quotes for newfield calculation and try.

0 Karma

jvmerilla
Path Finder

Hi @ansif,

I have also tried it already but it still doesn't work.

0 Karma

ansif
Motivator

Can I get the raw data?

0 Karma

jvmerilla
Path Finder

Hi @ansif,

I'm sorry but I cannot provide the raw data to you. But why do you need it?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...