topic Re: Need to compare 2 float values , after converting a string type to a float in Splunk Search

Need to compare 2 float values , after converting a string type to a float

vn_g — Thu, 07 Jan 2021 11:51:22 GMT

client_type = 'JDBC_DRIVER' , client_version = '3.9.2'
The above is the exact value in the lookup.

| rex field=clienttype_minimumversion_details max_match=0 "client_type\s=\s'(?<REPORTED_CLIENT_TYPE>.*?(?='\s,))"
| rex field=clienttype_minimumversion_details max_match=0 "client_version\s=\s'(?<MINIMUM_VERSION_REQUIRED>.*?(?='))"
Using the above I am extracting 2 fields

| eval version= tonumber(trim(MINIMUM_VERSION_REQUIRED))
| eval type=typeof(version)
The output of (MINIMUM_VERSION_REQUIRED) is Invalid

I need it in number format so that I can compare it to another numeric field in the logs.
I tried tonumber and convert , it doesnt work.

Re: Need to compare 2 float values , after converting a string type to a float

richgalloway — Thu, 07 Jan 2021 13:49:08 GMT

The conversion of MINIMUM_VERSION_REQUIRED fails because 3.9.2 is not a number (at least according to the mathematics I know). You might try stripping out the dots to get a numeric version.

Re: Need to compare 2 float values , after converting a string type to a float

rnowitzki — Thu, 07 Jan 2021 13:52:59 GMT

Hi @vn_g ,

Replace the dots with nothing I tested it with this - the output of "typeofversion" was "number" 🙂 :

| makeresults | eval MINIMUM_VERSION_REQUIRED="3.9.2" | eval MINIMUM_VERSION_REQUIRED=replace(MINIMUM_VERSION_REQUIRED,"\.","") | eval typeofversion=typeof(MINIMUM_VERSION_REQUIRED)

BR
Ralph

Re: Need to compare 2 float values , after converting a string type to a float

vn_g — Fri, 08 Jan 2021 05:36:50 GMT

For example , In my case I need to compare 2 floating point numbers.

Suppose 3.9.2 version is greater than 3.6.13 version and if I try to repace "." with "" and then compare , it gives incorrect results.

Re: Need to compare 2 float values , after converting a string type to a float

rnowitzki — Fri, 08 Jan 2021 08:53:07 GMT

Hi @vn_g

There might be a more dynamic solution that I can't think of right now, but this should work for you:

| makeresults | eval MINIMUM_VERSION_REQUIRED="3.9.209767" | eval COMPARE_VERSION="3.6.105" | eval MINIMUM_VERSION_REQUIRED=replace(MINIMUM_VERSION_REQUIRED,"\.","") | eval COMPARE_VERSION=replace(COMPARE_VERSION,"\.","") | eval zero_count=len(COMPARE_VERSION)-len(MINIMUM_VERSION_REQUIRED) | eval MINIMUM_VERSION_REQUIRED=case(zero_count<=0,MINIMUM_VERSION_REQUIRED,zero_count=1,MINIMUM_VERSION_REQUIRED+"0",zero_count=2,MINIMUM_VERSION_REQUIRED+"00",zero_count=3,MINIMUM_VERSION_REQUIRED+"000") | eval COMPARE_VERSION=case(zero_count>=0,COMPARE_VERSION,zero_count=-1,COMPARE_VERSION+"0",zero_count=-2,COMPARE_VERSION+"00",zero_count=-3,COMPARE_VERSION+"000")

If the length (~count of numbers) is different between the two version fields, it will add trailing zeros to make it match. Now you can compare.

This works with up to 3 more (or less) numbers in the two version fields (like compare 3.9.1. with 3.5.12.32)
If you expect even more sub/minor versions to compare, you would have to extend the two case statements with zero_count=4, VERSION_FIELD+"0000" etc.

BR
Ralph

Re: Need to compare 2 float values , after converting a string type to a float

vn_g — Fri, 08 Jan 2021 09:41:39 GMT

| makeresults
| eval MINIMUM_VERSION_REQUIRED="3.9.2"
| eval COMPARE_VERSION="3.12.9"
| eval MINIMUM_VERSION_REQUIRED=replace(MINIMUM_VERSION_REQUIRED,"\.","")
| eval COMPARE_VERSION=replace(COMPARE_VERSION,"\.","")
| eval zero_count=len(COMPARE_VERSION)-len(MINIMUM_VERSION_REQUIRED)
| eval MINIMUM_VERSION_REQUIRED=case(zero_count<=0,MINIMUM_VERSION_REQUIRED,zero_count=1,MINIMUM_VERSION_REQUIRED+"0",zero_count=2,MINIMUM_VERSION_REQUIRED+"00",zero_count=3,MINIMUM_VERSION_REQUIRED+"000",zero_count=4,MINIMUM_VERSION_REQUIRED+"0000")
| eval COMPARE_VERSION=case(zero_count>=0,COMPARE_VERSION,zero_count=-1,COMPARE_VERSION+"0",zero_count=-2,COMPARE_VERSION+"00",zero_count=-3,COMPARE_VERSION+"000",zero_count=-4,COMPARE_VERSION+"0000")
| where COMPARE_VERSION < MINIMUM_VERSION_REQUIRED

In the above case it still gives incorrect results . The COMPARE_VERSION field value is not less than MINIMUM_VERSION_REQUIRED.

Re: Need to compare 2 float values , after converting a string type to a float

rnowitzki — Fri, 08 Jan 2021 09:50:24 GMT

Ah, shoot. That's right. You challenge me 😛

I guess we have to define something like major version, minor version a, minor version to make it work...

Is there a max number of dots that you expect?

I mean, you seem to have 3.12.9 (major version + minor version a + minor version b) ...can there also be 3.12.9.4? (minor version c)?

Re: Need to compare 2 float values , after converting a string type to a float

vn_g — Fri, 08 Jan 2021 10:47:01 GMT

Yes , there can also be 3.12.9.4. Max number of dots can be 6.

Re: Need to compare 2 float values , after converting a string type to a float

rnowitzki — Fri, 08 Jan 2021 11:37:30 GMT

Solved it one simple eval statement 😛

The SPL I have looks a bit too much for the use case. But it works now (I know, I said this earlier...so please double check 🙂 )

| makeresults | eval MINIMUM_VERSION="3.9.2" | eval COMPARE_VERSION="3.5.2.1" | eval MINIMUM_VERSION_major=mvindex(split(MINIMUM_VERSION,"."),0), MINIMUM_VERSION_minora=mvindex(split(MINIMUM_VERSION,"."),1), MINIMUM_VERSION_minorb=mvindex(split(MINIMUM_VERSION,"."),2), MINIMUM_VERSION_minorc=mvindex(split(MINIMUM_VERSION,"."),3), MINIMUM_VERSION_minord=mvindex(split(MINIMUM_VERSION,"."),4), MINIMUM_VERSION_minore=mvindex(split(MINIMUM_VERSION,"."),5), MINIMUM_VERSION_minorf=mvindex(split(MINIMUM_VERSION,"."),6), COMPARE_VERSION_major=mvindex(split(COMPARE_VERSION,"."),0), COMPARE_VERSION_minora=mvindex(split(COMPARE_VERSION,"."),1), COMPARE_VERSION_minorb=mvindex(split(COMPARE_VERSION,"."),2), COMPARE_VERSION_minorc=mvindex(split(COMPARE_VERSION,"."),3), COMPARE_VERSION_minord=mvindex(split(COMPARE_VERSION,"."),4), COMPARE_VERSION_minore=mvindex(split(COMPARE_VERSION,"."),5), COMPARE_VERSION_minorf=mvindex(split(COMPARE_VERSION,"."),6), COMPARE_VERSION_minora = if(isnull(COMPARE_VERSION_minora),"0",COMPARE_VERSION_minora), COMPARE_VERSION_minorb = if(isnull(COMPARE_VERSION_minorb),"0",COMPARE_VERSION_minorb), COMPARE_VERSION_minorc = if(isnull(COMPARE_VERSION_minorc),"0",COMPARE_VERSION_minorc), COMPARE_VERSION_minord = if(isnull(COMPARE_VERSION_minord),"0",COMPARE_VERSION_minord), COMPARE_VERSION_minore = if(isnull(COMPARE_VERSION_minore),"0",COMPARE_VERSION_minore), COMPARE_VERSION_minorf = if(isnull(COMPARE_VERSION_minorf),"0",COMPARE_VERSION_minorf), MINIMUM_VERSION_minora = if(isnull(MINIMUM_VERSION_minora),"0",MINIMUM_VERSION_minora), MINIMUM_VERSION_minorb = if(isnull(MINIMUM_VERSION_minorb),"0",MINIMUM_VERSION_minorb), MINIMUM_VERSION_minorc = if(isnull(MINIMUM_VERSION_minorc),"0",MINIMUM_VERSION_minorc), MINIMUM_VERSION_minord = if(isnull(MINIMUM_VERSION_minord),"0",MINIMUM_VERSION_minord), MINIMUM_VERSION_minore = if(isnull(MINIMUM_VERSION_minore),"0",MINIMUM_VERSION_minore), MINIMUM_VERSION_minorf = if(isnull(MINIMUM_VERSION_minorf),"0",MINIMUM_VERSION_minorf), major_smaller = if(COMPARE_VERSION_major < MINIMUM_VERSION_major,"true","false"), minora_smaller = if(COMPARE_VERSION_minora < MINIMUM_VERSION_minora,"true","false"), minorb_smaller = if(COMPARE_VERSION_minorb < MINIMUM_VERSION_minorb,"true","false"), minorc_smaller = if(COMPARE_VERSION_minorc < MINIMUM_VERSION_minorc,"true","false"), minord_smaller = if(COMPARE_VERSION_minord < MINIMUM_VERSION_minord,"true","false"), minore_smaller = if(COMPARE_VERSION_minore < MINIMUM_VERSION_minore,"true","false"), minorf_smaller = if(COMPARE_VERSION_minorf < MINIMUM_VERSION_minorf,"true","false"), smaller_global = if(major_smaller="true", "true", if(minora_smaller="true", "true", if(minorb_smaller="true", "true", if(minorc_smaller="true", "true", if(minord_smaller="true", "true", if(minore_smaller="true", "true", if(minorf_smaller="true", "true","false" ))))))) | fields MINIMUM_VERSION, COMPARE_VERSION, smaller_global

The 2 blocks with mvindex are assigning the major and minor versions to fields.
Next 2 blocks fills "0" for the minor versions that don't exist.
Then we compoare the major and minor versions one by one and in the last eval for the smaller_global field is the main logic...if major is smaller = true, else if minora is smaller=true, else....

I guess the SPL can be shortened with some FOREACH magic, or when you skip assigning the major and minor versions to fields and work with the mvindex statement directly . But it would be less readable I think...

Re: Need to compare 2 float values , after converting a string type to a float

richgalloway — Fri, 08 Jan 2021 13:40:33 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

Re: Need to compare 2 float values , after converting a string type to a float

vn_g — Mon, 11 Jan 2021 07:54:55 GMT

Hi Ralph,

Thankyou so much for your time.

| eval MINIMUM_VERSION="3.9.2"
| eval COMPARE_VERSION="3.11.0"

The above is showing incorrect results.

smaller_global = 
if(major_smaller="true", "true",
if(minora_smaller="true", "true",
if(minorb_smaller="true", "true",
if(minorc_smaller="true", "true",
if(minord_smaller="true", "true",
if(minore_smaller="true", "true",
if(minorf_smaller="true", "true","false"
)))))))

Guess the above conditions needs to be re-valuated.

Thanks,

Nagasri.G

Re: Need to compare 2 float values , after converting a string type to a float

rnowitzki — Mon, 11 Jan 2021 09:53:19 GMT

Hi @vn_g ,

I guess I need more testing on my side 🙂

Version 0.4 of my SPL:

| makeresults | eval MINIMUM_VERSION="3.9.2" | eval COMPARE_VERSION="3.11.0" | eval MINIMUM_VERSION_major=mvindex(split(MINIMUM_VERSION,"."),0), MINIMUM_VERSION_minora=mvindex(split(MINIMUM_VERSION,"."),1), MINIMUM_VERSION_minorb=mvindex(split(MINIMUM_VERSION,"."),2), MINIMUM_VERSION_minorc=mvindex(split(MINIMUM_VERSION,"."),3), MINIMUM_VERSION_minord=mvindex(split(MINIMUM_VERSION,"."),4), MINIMUM_VERSION_minore=mvindex(split(MINIMUM_VERSION,"."),5), MINIMUM_VERSION_minorf=mvindex(split(MINIMUM_VERSION,"."),6), COMPARE_VERSION_major=mvindex(split(COMPARE_VERSION,"."),0), COMPARE_VERSION_minora=mvindex(split(COMPARE_VERSION,"."),1), COMPARE_VERSION_minorb=mvindex(split(COMPARE_VERSION,"."),2), COMPARE_VERSION_minorc=mvindex(split(COMPARE_VERSION,"."),3), COMPARE_VERSION_minord=mvindex(split(COMPARE_VERSION,"."),4), COMPARE_VERSION_minore=mvindex(split(COMPARE_VERSION,"."),5), COMPARE_VERSION_minorf=mvindex(split(COMPARE_VERSION,"."),6), COMPARE_VERSION_minora = if(isnull(COMPARE_VERSION_minora),"0",COMPARE_VERSION_minora), COMPARE_VERSION_minorb = if(isnull(COMPARE_VERSION_minorb),"0",COMPARE_VERSION_minorb), COMPARE_VERSION_minorc = if(isnull(COMPARE_VERSION_minorc),"0",COMPARE_VERSION_minorc), COMPARE_VERSION_minord = if(isnull(COMPARE_VERSION_minord),"0",COMPARE_VERSION_minord), COMPARE_VERSION_minore = if(isnull(COMPARE_VERSION_minore),"0",COMPARE_VERSION_minore), COMPARE_VERSION_minorf = if(isnull(COMPARE_VERSION_minorf),"0",COMPARE_VERSION_minorf), MINIMUM_VERSION_minora = if(isnull(MINIMUM_VERSION_minora),"0",MINIMUM_VERSION_minora), MINIMUM_VERSION_minorb = if(isnull(MINIMUM_VERSION_minorb),"0",MINIMUM_VERSION_minorb), MINIMUM_VERSION_minorc = if(isnull(MINIMUM_VERSION_minorc),"0",MINIMUM_VERSION_minorc), MINIMUM_VERSION_minord = if(isnull(MINIMUM_VERSION_minord),"0",MINIMUM_VERSION_minord), MINIMUM_VERSION_minore = if(isnull(MINIMUM_VERSION_minore),"0",MINIMUM_VERSION_minore), MINIMUM_VERSION_minorf = if(isnull(MINIMUM_VERSION_minorf),"0",MINIMUM_VERSION_minorf), major_bigger = if(COMPARE_VERSION_major > MINIMUM_VERSION_major,"true","false"), minora_bigger = if(COMPARE_VERSION_minora > MINIMUM_VERSION_minora,"true","false"), minorb_bigger = if(COMPARE_VERSION_minorb > MINIMUM_VERSION_minorb,"true","false"), minorc_bigger = if(COMPARE_VERSION_minorc > MINIMUM_VERSION_minorc,"true","false"), minord_bigger = if(COMPARE_VERSION_minord > MINIMUM_VERSION_minord,"true","false"), minore_bigger = if(COMPARE_VERSION_minore > MINIMUM_VERSION_minore,"true","false"), minorf_bigger = if(COMPARE_VERSION_minorf > MINIMUM_VERSION_minorf,"true","false"), major_smaller = if(COMPARE_VERSION_major < MINIMUM_VERSION_major,"true","false"), minora_smaller = if(COMPARE_VERSION_minora < MINIMUM_VERSION_minora,"true","false"), minorb_smaller = if(COMPARE_VERSION_minorb < MINIMUM_VERSION_minorb,"true","false"), minorc_smaller = if(COMPARE_VERSION_minorc < MINIMUM_VERSION_minorc,"true","false"), minord_smaller = if(COMPARE_VERSION_minord < MINIMUM_VERSION_minord,"true","false"), minore_smaller = if(COMPARE_VERSION_minore < MINIMUM_VERSION_minore,"true","false"), minorf_smaller = if(COMPARE_VERSION_minorf < MINIMUM_VERSION_minorf,"true","false"), smaller_global = if(major_smaller="true", "true",if(major_bigger="true", "false", if(minora_smaller="true", "true",if(minora_bigger="true", "false", if(minorb_smaller="true", "true",if(minorb_bigger="true", "false", if(minorc_smaller="true", "true",if(minorc_bigger="true", "false", if(minord_smaller="true", "true",if(minord_bigger="true", "false", if(minore_smaller="true", "true",if(minore_bigger="true", "false", if(minorf_smaller="true", "true",if(minorf_bigger="true", "false","versions_are_equal" )))))))))))))) | fields MINIMUM_VERSION, COMPARE_VERSION, smaller_global

Now checking both for each major/minorversion: If it's bigger or smaller. If either or is true, it breaks out. If not then the minor is equal and it goes to the next one...

It prints "versions_are_ equal" if everything is equal. You could change that to "false", since equal is still "not smaller"...

Please run some tests again.

BR
Ralph

Re: Need to compare 2 float values , after converting a string type to a float

vn_g — Tue, 12 Jan 2021 05:50:28 GMT

This query is working as expected. Thankyou so much.