topic Re: Why am I unable to convert a string to numeric? in Splunk Search

Why am I unable to convert a string to numeric?

sjafferali — Fri, 20 Apr 2018 17:21:24 GMT

I am trying to convert a string to numeric but it is not getting converted.

index="dnr_ecc" jobname="*IC*HV_TREX" | eval runtime = tonumber(total_run_time) |
table jobname total_run_time runtime

Runtime field is displaying as blank. I need this to covert to numeric so I can use the sum functional to sum the runtime.

Any help is much appreciated.

Re: Why am I unable to convert a string to numeric?

sjafferali — Tue, 29 Sep 2020 19:10:52 GMT

I tried the below after using the convert command, but the result comes as "False"

index="dnr_ecc" jobname="*IC*HV_TREX" | convert num(total_run_time) as runtime |
eval result=if(isNum(runtime),"True","False") |
table result

Re: Why am I unable to convert a string to numeric?

elliotproebstel — Fri, 20 Apr 2018 17:49:22 GMT

Can you give some sample values for the total_run_time field that you're trying to convert?

Re: Why am I unable to convert a string to numeric?

somesoni2 — Fri, 20 Apr 2018 18:18:03 GMT

Try this

index="dnr_ecc" jobname="*IC*HV_TREX" |convert dur2sec(total_run_time) as runtime |
 table jobname total_run_time runtime

Re: Why am I unable to convert a string to numeric?

sjafferali — Tue, 29 Sep 2020 19:11:00 GMT

total run time looks like in numberic format. it is in seconds like if 3400 seconds is the runtime, total_run_time will have "3400", if 15000 then "15000"

Re: Why am I unable to convert a string to numeric?

sjafferali — Fri, 20 Apr 2018 18:47:48 GMT

during dur2sec is still not working.

Re: Why am I unable to convert a string to numeric?

elliotproebstel — Fri, 20 Apr 2018 19:20:15 GMT

Does the field contain something besides just a number? What do you get from this:

index="dnr_ecc" jobname="*IC*HV_TREX" total_run_time=*
| head 5
| stats values(total_run_time)

Can you copy and paste the results here?

Re: Why am I unable to convert a string to numeric?

somesoni2 — Tue, 29 Sep 2020 19:09:40 GMT

Does total_run_time has value 3400 seconds (number with string unit in it) OR just 3400?

Re: Why am I unable to convert a string to numeric?

elliotproebstel — Fri, 20 Apr 2018 20:07:49 GMT

If total_run_time looks like "3400 seconds", then you could use a rex command to extract the first series of numbers it encounters in the field:

| rex mode=sed field=total_run_time "s/^(\d+)([^\d].*)/\1/"

So that would turn 3400 seconds into 3400.

Re: Why am I unable to convert a string to numeric?

sjafferali — Tue, 29 Sep 2020 19:11:03 GMT

I ran the query you gave
index="dnr_ecc" jobname="IC*HV_TREX" total_run_time= | head 5 | stats values(total_run_time)
Result is as below. There is no text in the field.

values(total_run_time)
1540
1751
1780
1832

Re: Why am I unable to convert a string to numeric?

sjafferali — Tue, 29 Sep 2020 19:11:06 GMT

I ran the query you gave
index="dnr_ecc" jobname="IC*HV_TREX" total_run_time= | head 5 | stats values(total_run_time)
Result is as below. There is no text in the field.

values(total_run_time)
1540
1751
1780
1832

Re: Why am I unable to convert a string to numeric?

sjafferali — Fri, 20 Apr 2018 21:13:34 GMT

It has just 3400

Re: Why am I unable to convert a string to numeric?

woodcock — Fri, 20 Apr 2018 23:04:25 GMT

The problem is usually whitespace so try this:

index="dnr_ecc" jobname="*IC*HV_TREX"
| eval runtime = tonumber(replace(total_run_time, "[\r\n\s]+", ""))

Re: Why am I unable to convert a string to numeric?

niketn — Tue, 29 Sep 2020 19:09:49 GMT

@sjafferali, can there be spaces before or after numeric total_run_time which may treat it as string? Can you try the following?

 index="dnr_ecc" jobname="*IC*HV_TREX" 
| eval total_run_time=replace(total_run_time,"\s+","")
| eval runtime = tostring(total_run_time,"duration")
| table jobname total_run_time runtime

PS: tostring(<yourFieldName>,"duration") converts seconds to days+ HH:MM:SS. If your need just numeric replace() eval should do. Following is the run-anywhere example with spaces around data:

| makeresults
| eval total_run_time=" 1540 ; 1751 ; 1780 ; 1832 "
| makemv total_run_time delim=";"
| mvexpand total_run_time
| eval total_run_time=replace(total_run_time,"\s+","")
| eval runtime = tostring(total_run_time,"duration")

Re: Why am I unable to convert a string to numeric?

TISKAR — Sat, 21 Apr 2018 12:50:10 GMT

@sjafferali, you can use trim command to remove space, try this:

 index="dnr_ecc" jobname="*IC*HV_TREX"  | eval runtime = tonumber(trim(total_run_time," ")) |
 table jobname total_run_time runtime

Re: Why am I unable to convert a string to numeric?

sjafferali — Tue, 29 Sep 2020 19:12:01 GMT

Thanks Everyone for your response and Thanks Niketnilay.

The command below worked. Looks like there were blank spaces after the numbers. I was able to chart the total runtime by day which provides a trend analysis.

eval total_run_time=replace(total_run_time,"\s+","")

Re: Why am I unable to convert a string to numeric?

sjafferali — Tue, 29 Sep 2020 19:12:03 GMT

Hi Somesoni2 - Thank you for your multiple immediate responses. I really appreciate your help.

The command below worked for my scenario.

eval total_run_time=replace(total_run_time,"\s+","")