topic Re: Why does the trim function not work on numeric values without spaces? in Splunk Search

Why does the trim function not work on numeric values without spaces?

anantdeshpande — Thu, 15 Dec 2016 12:14:52 GMT

Hi,
We have a column where value can be string, alphanumeric, numeric, and with/without spaces before and after it.
Trim function works perfect for string, alphanumeric values with or without spaces. It also works when value is numeric with space.
However, when value is numeric and without any space, it displays in exponential format.

Trim works when data is like: "G12345", "G98765 ", "UPHAV", OUGNJGF ", "67537658 "

Trim displays in exponential when data is like: "98753567" (Number without space) displays like (1.49554e+09).

1) Is there any alternative to trim, which is generic and satisfies all above condition?
2) Can we have any if condition to find out a value which is numeric but without any space before and after it?

Re: Why does the trim function not work on numeric values without spaces?

richgalloway — Thu, 15 Dec 2016 13:45:38 GMT

Which version of Splunk are you using? What is your SPL? I can't reproduce this in 6.5.1.

Re: Why does the trim function not work on numeric values without spaces?

tkomatsubara_sp — Thu, 15 Dec 2016 14:39:21 GMT

| makeresults |eval a=98753567 | eval b=trim(a)

What do you mean?

This example shows no problem.

Re: Why does the trim function not work on numeric values without spaces?

anantdeshpande — Thu, 15 Dec 2016 16:59:36 GMT

I am using Splunk 6.2
| makeresults |eval a=98753567 | eval b=trim(a) - using same in 6.2 is not working

Can anyone try and let us know if thats the limitation in 6.2

Re: Why does the trim function not work on numeric values without spaces?

somesoni2 — Thu, 15 Dec 2016 17:10:09 GMT

The command makeresults is available only on 6.3.x and above. I've tried similar search (below) on 6.2.6 and 6.2.12 it works just fine.

| gentimes start=-1  |eval a=98753567 | table a | eval b=trim(a)

Re: Why does the trim function not work on numeric values without spaces?

anantdeshpande — Tue, 29 Sep 2020 12:10:16 GMT

Sorry, I am not using makeresults. My query looks like below:
Index=abc sourcetype=xyz | eval CUST_ID=123456 | eval NEW_CUST_ID=trim(CUST_ID)

Re: Why does the trim function not work on numeric values without spaces?

somesoni2 — Thu, 15 Dec 2016 19:00:22 GMT

Would you be able to post a screenshot of the search result? Something similar works just fine for me on 6.2.6.

index=_internal sourcetype=splunkd | eval CUST_ID=123456 | eval NEW_CUST_ID=trim(CUST_ID)

Re: Why does the trim function not work on numeric values without spaces?

niketn — Thu, 15 Dec 2016 19:52:53 GMT

How about when you convert from number to string?

   <your base search> | eval a=tostring(a) | eval b=trim(a)

Re: Why does the trim function not work on numeric values without spaces?

anantdeshpande — Tue, 29 Sep 2020 12:10:24 GMT

Hi,
Looks like issue is when digits are more than 6 digits. works when CUST_ID is 123456 but gives exponential when CUST_ID is 1234567 . Please try on Splunk 6.2 .

index=_internal sourcetype=splunkd | eval CUST_ID=1234567 | eval NEW_CUST_ID=trim(CUST_ID)

Re: Why does the trim function not work on numeric values without spaces?

anantdeshpande — Fri, 16 Dec 2016 05:19:42 GMT

also, our Splunk is 6.2.0

Re: Why does the trim function not work on numeric values without spaces?

nekbote — Tue, 29 Sep 2020 12:08:19 GMT

your spl does give exponential error in 6.2.2...

You can try appending space in your evail and then continue to use trim...this will ensure numric value with no space gets a space and your trim continues to work..below SPL works just fine

index=_internal sourcetype=splunkd | eval CUST_ID=1234567 |eval CUST_ID=CUST_ID." "| eval NEW_CUST_ID=trim(CUST_ID) | table NEW_CUST_ID

Re: Why does the trim function not work on numeric values without spaces?

nekbote — Tue, 29 Sep 2020 12:08:22 GMT

with one less eval compared to previous one..
index=_internal sourcetype=splunkd | eval CUST_ID=12345678910 | eval NEW_CUST_ID=trim(CUST_ID." ") | table NEW_CUST_ID

Re: Why does the trim function not work on numeric values without spaces?

anantdeshpande — Wed, 21 Dec 2016 06:56:57 GMT

Hi all, Thanks for the comments. TRIM function on number without space in Splunk 6.2.0 is not working for us.
However cust_id=replace(cust_id, " ","") [there is space between first double cote] is working perfectly for all data with or without space.