https://community.splunk.com/t5/Splunk-Search/How-to-convert-scientific-notation-to-decimal/m-p/98512#M25359 <P><CODE>tonumber()</CODE> call works now in 6.x</P> <PRE><CODE>... | eval sci_no="7.6e+02" | eval result=tonumber(sci_no) </CODE></PRE> <P>yields result of <CODE>760</CODE></P> Thu, 10 Apr 2014 22:33:46 GMT tchen_splunk 2014-04-10T22:33:46Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-scientific-notation-to-decimal/m-p/98510#M25357 <P>We log several values in scientific notation and wanted to know if anybody has used Splunk to convert these values to decimals.</P> Wed, 26 Oct 2011 17:25:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-scientific-notation-to-decimal/m-p/98510#M25357 kbecker 2011-10-26T17:25:33Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-scientific-notation-to-decimal/m-p/98511#M25358 <P>It's a bit of a pain, and I haven't fully tested it, but try this</P> <PRE><CODE>your-search-here | eval parts = split(input,"E") | eval part1 = tonumber(mvindex(parts,0)) | eval part2 = tonumber(mvindex(parts,1)) | eval dec = exact((part1) * pow(10,part2)) | fields - parts part1 part2 </CODE></PRE> <P>Substitute the name of your field for <STRONG>input</STRONG> in the search, and the resulting number number will be found in the <STRONG>dec</STRONG> field.</P> <P>Now, I don't think that you want to type this in every time! So, create a macro. Here's how in the manual <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndUseSearchMacros">Create and Use Search Macros</A></P> <P>Put the following into the macro definition:</P> <PRE><CODE>eval parts = split($input$,"E") | eval part1 = tonumber(mvindex(parts,0)) | eval part2 = tonumber(mvindex(parts,1)) | eval $dec$ = exact((part1) * pow(10,part2)) | fields - parts part1 part2 </CODE></PRE> <P>Notice that I've modified the string slightly so that it becomes a macro with two arguments:<BR /><BR /> <STRONG>input</STRONG> - the name of the field that contains the string (the number in scientific notation<BR /><BR /> <STRONG>dec</STRONG> - the name of the field that will contain the resulting decimal number<BR /></P> <P>If you name the macro <CODE>convert</CODE>, then you can use it like this</P> <P>your-search-here | `convert(sciNum,decNum)` | table sciNum, decNum</P> <P>Note the use of the back-quote, not the single quote, around the macro. In the example, sciNum must be the name of your existing field. decNum will be created if it does not already exist.</P> Thu, 27 Oct 2011 09:10:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-scientific-notation-to-decimal/m-p/98511#M25358 lguinn2 2011-10-27T09:10:45Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-scientific-notation-to-decimal/m-p/98512#M25359 <P><CODE>tonumber()</CODE> call works now in 6.x</P> <PRE><CODE>... | eval sci_no="7.6e+02" | eval result=tonumber(sci_no) </CODE></PRE> <P>yields result of <CODE>760</CODE></P> Thu, 10 Apr 2014 22:33:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-scientific-notation-to-decimal/m-p/98512#M25359 tchen_splunk 2014-04-10T22:33:46Z