topic CSV files with scientific notation fields in Getting Data In

CSV files with scientific notation fields

external_alien_ — Fri, 22 Jul 2016 12:36:16 GMT

I have a folder monitored by Splunk where CSV files are uploaded and sucked into Splunk. Splunk reads them no sweat and I can work with the data, the only problem is that the numerical values in the CSV files are all in Scientific notation and look for example like “2.7584000000000e+04” instead of simply “27584”. Splunk interprets them as numerical (not string) and I can fix this at search time with a few evals, but I have to do it for every search and was wondering if there's no way to fix this before the CSV files are indexed in Splunk? Say via editing props.conf?

Any help is much appreciated 😃

Re: CSV files with scientific notation fields

woodcock — Fri, 22 Jul 2016 12:43:57 GMT

You can setup your eval statements as calculated fields using the EVAL- syntax here:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Propsconf

Re: CSV files with scientific notation fields

external_alien_ — Fri, 22 Jul 2016 13:56:02 GMT

But doesn't that mean I have to know all the field names beforehand? Seeing as I have a large number of fields with values in scientific notation this is unfeasible, not to mention that field names may vary 😃
Is it theoretically possible to identify all values that contain say "e+" and rework them as plain decimal?

Re: CSV files with scientific notation fields

woodcock — Fri, 22 Jul 2016 14:10:07 GMT

In that case, you need to create a macro using foreach and then use it whenever you need it. That is the best that you can do. Unfortunately, you cannot make the macro call automatic.