topic Re: Convert Multivalue field into Number in Splunk Search

Convert Multivalue field into Number

matthaeus — Tue, 22 Sep 2020 11:48:08 GMT

Hey there,

I have extracted chart data from the raw field into multivalue fields. But I can't chart the data since splunk doesn't recoginse the the fields as numbers.

x_axis	y_axis
-1.292015 -1.282425 -1.27523 -1.26725 -1.258461 -1.248871	4.9024 5.129161 5.200173 5.327875 5.909696 6.406182

I have tried to convert it using:

|eval x_axis2=tonumber(trim(x_axis))

or:

| Convert num(x_axis)

but both didn't work. Could anybody help me out here?

Re: Convert Multivalue field into Number

ITWhisperer — Tue, 22 Sep 2020 11:58:36 GMT

Try this:

| eval x_axis=mvmap(x_axis, tonumber(x_axis)) | eval y_axis=mvmap(y_axis, tonumber(y_axis))

Re: Convert Multivalue field into Number

matthaeus — Tue, 22 Sep 2020 12:00:57 GMT

Hmm.. it just gives me the error message: Error in 'eval' command: The 'mvmap' function is unsupported or undefined.

Re: Convert Multivalue field into Number

ITWhisperer — Tue, 22 Sep 2020 12:02:53 GMT

Which version of splunk are you running?

Re: Convert Multivalue field into Number

ITWhisperer — Tue, 22 Sep 2020 12:07:48 GMT

Can you extract the x-axis and y-axis values into separate event rather than multi-value fields? if not, you could mvzip them together with a suitable delimiter, then mvexpand to get separate events. Then split the field and re-evaluate x-axis and y-axis. Then you will have something to chart.

Re: Convert Multivalue field into Number

matthaeus — Tue, 22 Sep 2020 12:05:08 GMT

Splunk Enterprise

Version:7.2.10

Re: Convert Multivalue field into Number

matthaeus — Tue, 22 Sep 2020 12:07:39 GMT

How exactly do you mean?

So I have extracted it using:

| rex field=_raw max_match=0 (?<x_axis>.\d.\d+);(?<y_axis>\d+.\d+)

Sorry, I'm quite new to splunk 😀

Re: Convert Multivalue field into Number

matthaeus — Tue, 22 Sep 2020 12:13:20 GMT

So I think I actually don't have a multivalue field, splunk just recognises it as one since it sees the "." as a delimiter rather than a comma.

Re: Convert Multivalue field into Number

thambisetty — Tue, 22 Sep 2020 12:16:49 GMT

add below search to your search

below will create sample events as well and show your results:

| makeresults | eval x_axis="-1.292015,-1.282425,-1.27523,-1.26725,-1.258461,-1.248871",y_axis="4.9024,5.129161,5.200173,5.327875,5.909696,6.406182" | eval x_axis=split(x_axis,","),y_axis=split(y_axis,",") | eval combine=mvzip(x_axis,y_axis) | fields - x_axis,y_axis | mvexpand combine | eval x_axis=mvindex(split(combine,","),0),y_axis=mvindex(split(combine,","),1) | fields - combine | table x_axis y_axis

Re: Convert Multivalue field into Number

matthaeus — Tue, 22 Sep 2020 12:27:14 GMT

Thanks so much for your suggested solution, but for some reason I already don't have any results after the first line:

| eval x_axis=split(x_axis,","),y_axis=split(y_axis,",")