https://community.splunk.com/t5/Splunk-Search/Buffer-overflow-for-field/m-p/125734#M33984 <P>I don't work for Splunk, so can't answer this with 100% certainty, but the fact that the first 15 digits are fine and the last 9 are random suggests that internally Splunk is storing numeric field values as IEEE double precision floating point values, which have 15 digits of accuracy.</P> <P>Splunk doesn't corrupt text fields that are longer than 15 characters, so one workaround would be to put a letter at the beginning of your 1s and 0s so that the overall field is text rather than numeric. Presumably you're testing individual bits to see if they're 0 or 1 using substr() or similar, so you could still do this if there was a letter at the beginning of the field.</P> Tue, 05 Nov 2013 17:42:06 GMT dmr195 2013-11-05T17:42:06Z https://community.splunk.com/t5/Splunk-Search/Buffer-overflow-for-field/m-p/125733#M33983 <P>Hi !</P> <P>I would like to know if there are any restricted size value for fields.</P> <P>I have tried to create a fields consisting </P> <P>24 0's and 1 <BR /> 10000000000000000000000000</P> <P>result was</P> <P>10000000000000000905969664</P> <P>It seems like a bufferover flow or something.</P> <P>Any help is appreciated!</P> <P>Thanks,<BR /> Yu</P> Fri, 01 Nov 2013 12:46:54 GMT https://community.splunk.com/t5/Splunk-Search/Buffer-overflow-for-field/m-p/125733#M33983 yuwtennis 2013-11-01T12:46:54Z https://community.splunk.com/t5/Splunk-Search/Buffer-overflow-for-field/m-p/125734#M33984 <P>I don't work for Splunk, so can't answer this with 100% certainty, but the fact that the first 15 digits are fine and the last 9 are random suggests that internally Splunk is storing numeric field values as IEEE double precision floating point values, which have 15 digits of accuracy.</P> <P>Splunk doesn't corrupt text fields that are longer than 15 characters, so one workaround would be to put a letter at the beginning of your 1s and 0s so that the overall field is text rather than numeric. Presumably you're testing individual bits to see if they're 0 or 1 using substr() or similar, so you could still do this if there was a letter at the beginning of the field.</P> Tue, 05 Nov 2013 17:42:06 GMT https://community.splunk.com/t5/Splunk-Search/Buffer-overflow-for-field/m-p/125734#M33984 dmr195 2013-11-05T17:42:06Z