topic Re: converting an triming field values in Splunk Search

converting an triming field values

codedtech — Fri, 12 Jul 2019 16:54:24 GMT

I need to to convert this field in to a number and remove the $ capacity_gb = $8,191.75, I've tried eval to num and convert, but nothing worked.

richgalloway — Fri, 12 Jul 2019 18:23:47 GMT

To clarify, what do you get from | eval x = tonumber(capacity_gb) | table capacity_gb x ?

codedtech — Fri, 12 Jul 2019 19:43:13 GMT

Yes, and the output is displayed like this:
capacity_gb x
$8,191.75

renjith_nair — Sat, 13 Jul 2019 05:50:18 GMT

@codedtech .

Try

|rex mode=sed field=capacity_gb "s/[^\d\.]//g"

If you need , also part of you value, just add , to the square bracket

vnravikumar — Sat, 13 Jul 2019 07:23:34 GMT

Try this

| makeresults 
| eval capacity_gb = "$8,191.75" 
| eval capacity_gb = replace(capacity_gb,"\$","")