topic Re: How to convert String values into factor variable? in Splunk Search

How to convert String values into factor variable?

zacksoft — Wed, 18 Apr 2018 13:18:57 GMT

I have string fields; an example is "URL".

I want it to convert it to numeric / factor variable to perform statistical calculation.

Example:
Field URL contains values like
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Blunk.com/
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Bplunk.com/
https://answers.Cplunk.com/

It should be converted into 1, 2, 2, 1, 2, 2, 3

(All the 1's are same type of string, 2's are same type string, and same goes with 3)

I hope I explain it correctly.

Re: How to convert String values into factor variable?

damien_chillet — Wed, 18 Apr 2018 13:30:54 GMT

Not sure that will work with your use case, but could you try add the following to your search

| sort <your_field>
| streamstats dc(<your_field>) as num

Re: How to convert String values into factor variable?

zacksoft — Wed, 18 Apr 2018 13:37:42 GMT

I tried it. Not quite sure what it did. I am hoping to see the result in a table format. Then it would be easy for me to see and verify the result.

Re: How to convert String values into factor variable?

FrankVl — Wed, 18 Apr 2018 13:40:14 GMT

Why would you need to convert the URL to a numeric value to be able to perform statistical calculations?

Re: How to convert String values into factor variable?

zacksoft — Wed, 18 Apr 2018 13:42:11 GMT

I want to know how many times that specific http request is requested and what were the corresponding response times for all those requests ... and some similar other calculation.

Re: How to convert String values into factor variable?

damien_chillet — Wed, 18 Apr 2018 13:45:30 GMT

 | table <your_field>
 | sort <your_field>
 | streamstats dc(<your_field>) as num

Where is the field containing url

Re: How to convert String values into factor variable?

FrankVl — Wed, 18 Apr 2018 14:08:53 GMT

But that can simply be done by | stats count by url right? No need to convert it to a number first.

Re: How to convert String values into factor variable?

zacksoft — Wed, 18 Apr 2018 14:11:12 GMT

@damien_chillet
As it appears, You Sir have solved my problem.

Re: How to convert String values into factor variable?

damien_chillet — Wed, 18 Apr 2018 14:14:39 GMT

Glad it worked!
I have converted my comment as an answer.
Could you please accept it to close the question?

Re: How to convert String values into factor variable?

damien_chillet — Wed, 18 Apr 2018 14:17:07 GMT

Note: you might want to look at @FrankVI comments, you may well be able to retrieve stats without converting to numeric in the first place (unless what you wanna do is very specific and original 🙂 )

Re: How to convert String values into factor variable?

zacksoft — Wed, 18 Apr 2018 14:38:35 GMT

Thanks Frank. Your suggestion serves the purpose. In @damien_chillet 's suggestion I am able to see the urls and I can add another value next to it , like response time.

Example : If xxx.yyy.zzz is called 4 times , then how much time it took to respond in all those four calls separately. I am able to see it easily.