topic How to convert String to Integer search? in Splunk Enterprise Security

How to convert String to Integer search?

umesh — Thu, 03 Nov 2022 14:23:19 GMT

Hi team,

I have "file_size" in my extracted fields and the values are 1.56 KB,5.03 MB, 1.06 B. and those values are strings. I need a query how to convert string to Integer to sum(file_size) i need to use max and min and sum commands for the file_size. Please help me on the same.

Thanks

Re: convert String to Integer search

bowesmana — Thu, 03 Nov 2022 07:24:10 GMT

Here's an example - you need the rex and eval statements

| makeresults | eval file_size=split("1.56 KB,5.03 MB,1.06 B,1MB,4.95 GB,5.13TB", ",") | mvexpand file_size | rex field=file_size "(?<size>\d+(\.\d+)?)\s?(?<mul>\w+)?" | eval file_size=case(mul="KB", size * 1024, mul="MB", size * 1024 * 1024, mul="GB", size * 1024 * 1024 * 1024, mul="TB", size * 1024 * 1024 * 1024 * 1024, 1==1, size)