Splunk Search

Convert string to decimal number

Matthias_BY
Communicator

Hello,

i have a field extraction where i have values who are like 21,3

splunk recognizes them as string. but that are temprature data and i like to have tham as decimal numbers so i fan calculate avarage, lines etc.

how can i convert them?
thanks

Tags (1)
0 Karma
1 Solution

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

View solution in original post

Matthias_BY
Communicator

Hi

thanks for the tips. i have found out that the software which writes the machine data (cumulus from sandysoft) is using the decimal delimeter from the regional settings on windows.

i reconfigured on this server to use the dot instead of the comma and now i have my data nice. i'm sure it might have been corrected via props and transform with splunk but that one was the fastest and easiest way.

br
matthias

0 Karma

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...