topic Re: Decimal : how to use "," vs "." ? in Splunk Search

Decimal : how to use "," vs "." ?

arturo — Wed, 14 Mar 2012 20:27:15 GMT

Folks :

I have a customer using numbers in "spanish" standard (a number in the US Standard like 1,000,000.25 is represented in logs as 1.000.000,25)

How can I change that at search time ? Is it possible ?

I have tried to use "eval nn=tonumber(variable) but it can't convert a number in the format before mentioned (1.000.000,25)

Cheers
Arturo

Re: Decimal : how to use "," vs "." ?

araitz — Wed, 14 Mar 2012 21:08:02 GMT

There is probably a more elegant way, but:

...| eval var = replace(var, ",", ".") | eval var = replace(var, "\.([^\.]+)$", ",\1")

It would probably be easiest to make this in to a macro for reuse.

Re: Decimal : how to use "," vs "." ?

ziegfried — Thu, 15 Mar 2012 10:19:53 GMT

It's probably better to eliminate the separating dots before replacing commas.

... | eval nn=tonumber(replace(replace(variable,"\.",""),",",".")) | ...

Re: Decimal : how to use "," vs "." ?

arturo — Thu, 15 Mar 2012 12:03:51 GMT

Thanks guys !!!!!! ... great ideas indeed !!!!!!!!!!!

Question : are there any "permanent/faster" ways to make this "standard" for numeric quantities the "standard" for a customer installation ?

I was thinking that something Just like http://www.splunk.com/base/Documentation/latest/Admin/Configurecharactersetencoding should exist "built in" in Splunk to make him aware of other standards ... maybe at index time ?

Cheers

Re: Decimal : how to use "," vs "." ?

ziegfried — Thu, 15 Mar 2012 12:08:35 GMT

Transforming something like this at index time is probably a bad idea. Even the field extraction happen at search time. An enhancement that might be useful is a locale-aware string-to-number conversion for eval.

Re: Decimal : how to use "," vs "." ?

arturo — Tue, 15 May 2012 20:04:11 GMT

Is that locale-aware "string-to-number" convertion option available ?

Any pointers ?

Re: Decimal : how to use "," vs "." ?

ziegfried — Wed, 16 May 2012 16:07:44 GMT

No, not atm.