topic Re: How to convert the values of multiple fields to number? in Splunk Search

How to convert the values of multiple fields to number?

jvmerilla — Thu, 14 Jun 2018 04:09:35 GMT

Hi All,

Good day!

I just want to ask for some help here. 🙂

I have multiple fields with the data I'm working on with values, "0, 1, 2, 3, 4, 5, NULL".
Ex.

I replace the "NULL" values and replace it with space, " ", and add all of these fields and put it in a new field with this code:

| replace NULL WITH " " IN "FIELD A" "FIELD B" "FIELD C" "FIELD D" "FIELD E"
| eval newField ="FIELD A" +  " FIELD B" + " FIELD C" + "" FIELD D" + " FIELD E"

But instead of adding the values of the fields, it concatenates it like like this:

Notice that the events where there was a "NULL" values where seem to be treated as a string.

I tried to use the tonumber() function to convert it to string but it doesn't work.
Ex:

|eval "FIELD A" = tonumber("FIELD A")
|eval "FIELD B" = tonumber("FIELD B")
|eval "FIELD C" = tonumber("FIELD C")
|eval "FIELD D" = tonumber("FIELD D")
|eval "FIELD E" = tonumber("FIELD E")

What could be the possible cause of this issue and what could be the solution?

Thanks! 🙂

Re: How to convert the values of multiple fields to number?

ansif — Thu, 14 Jun 2018 04:52:18 GMT

Remove double quotes for newfield calculation and try.

Re: How to convert the values of multiple fields to number?

jvmerilla — Thu, 14 Jun 2018 05:12:45 GMT

Hi @ansif,

I have also tried it already but it still doesn't work.

Re: How to convert the values of multiple fields to number?

ansif — Thu, 14 Jun 2018 05:23:29 GMT

Can I get the raw data?

Re: How to convert the values of multiple fields to number?

jvmerilla — Thu, 14 Jun 2018 05:29:05 GMT

Hi @ansif,

I'm sorry but I cannot provide the raw data to you. But why do you need it?

Re: How to convert the values of multiple fields to number?

493669 — Thu, 14 Jun 2018 08:27:26 GMT

try this:

...|replace NULL with 0|eval newField ='FIELD A' +  'FIELD B' + 'FIELD C' + 'FIELD D' + 'FIELD E'