topic Re: Splunk treats any number that uses E (instead of *10) as a string in Splunk Search

Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Mon, 09 Feb 2015 16:55:21 GMT

Any number such as 1.23456E-3 (equivalent to 1.23456*10^-3 or 0.00123456) is recognised by splunk as a string rather than it either converting it to only contain numbers or knowing that E is equivalent to *10. Just wondering if there is a simple way of getting splunk to change this?

Re: Splunk treats any number that uses E (instead of *10) as a string

skawasaki_splun — Mon, 09 Feb 2015 17:27:50 GMT

It's a little long, but it works:

| stats count | eval string="1.23456E-3" | rex field=string "^(?<base>.+)E(?<power>.+)$" | eval number=base*pow(10, power)

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Tue, 10 Feb 2015 10:03:46 GMT

This works if I have a specific field that I know needs converting. However, in my case I have a large table with about seven different columns and some numbers contain 'E' and some don't. What I need is more of a way for splunk to see any number that goes through the search and make sure it has been converted to not include E. Is there a way of doing this? Or does this method work but I'm using it in the wrong way?

Re: Splunk treats any number that uses E (instead of *10) as a string

skawasaki_splun — Wed, 11 Feb 2015 16:43:36 GMT

If the "number" doesn't contain "E" then the regex won't even capture and no extra work is needed. You may want to remove the extra fields with | fields - base power. Also to perform the regex on more fields, then look into | foreach.

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Thu, 19 Feb 2015 16:32:18 GMT

I have discovered that in fact splunk does know this is a number however it refuses to plot anything containing "E" on a graph, which is even more strange, but that's another question. You can do maths with a number containing E on splunk.

Re: Splunk treats any number that uses E (instead of *10) as a string

markthompson — Fri, 20 Feb 2015 15:18:03 GMT

Here's an answer for you.

If your number contains E, Splunk will recognise it as a string and will allow you to do maths with it, but not plot it on a graph, To fix this, you can multiply the field by 1 or 10 to the power of 0 (1) which will give you the actual number and this can be plotted onto a graph

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:20:57 GMT

Hi Mark,
Thanks for your answer, but Splunk does recognize it as a number and thus you are incorrect.

Re: Splunk treats any number that uses E (instead of *10) as a string

markthompson — Fri, 20 Feb 2015 15:24:29 GMT

Hi Toby,
Going by the definition of a "Number": a quantity or amount.

Hence making your field an alphanumeric value, which is recognised as a string.

Please remove your negative vote, as technically it is a valid answer.

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:27:24 GMT

Maths would not be possible if it were a string. Please could you remove your answer as it is clearly invalid.

Re: Splunk treats any number that uses E (instead of *10) as a string

markthompson — Fri, 20 Feb 2015 15:31:49 GMT

Toby, I appreciate that Splunk allows you to do maths with the E in there.
But by Documentation of the Eval command (http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Eval)

Maths will be done with any Alphanumeric field (Does not need to be a Number), it will only error in the event it is a Non-Alphanumeric Field.

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:32:32 GMT

Normally I would agree, however I believe in this case E is not recognised as a letter, but as its actual scientific meaning, which is *10^. If you wish to escalate this matter further we should arrange a place to meet and sort out our differences like real men, in the form of street countdown.

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:35:57 GMT

For more information on street countdown, watch The IT Crowd

Re: Splunk treats any number that uses E (instead of *10) as a string

markthompson — Fri, 20 Feb 2015 15:37:33 GMT

HI Toby, Documentation is based on how the coding behind Splunk works, in the event you wish to argue this, please contact Splunk support (support@splunk.com) who i'm sure will be able to clarify why this works for you, or if you believe their documentation is wrong, be able to discuss it.

There is no room for disagreement and as such please remove your negative vote as it does not contribute to the community as they may believe it's not a correct answer, when in actual fact, it's factually correct.

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:40:08 GMT

I will definitely email them later, but not to ask... To prove that I, Toby6578, am correct in this instance (and all others). I don't know who you are. I don't know what you want. If you are looking for badges, I can tell you I don't have karma. But what I do have are a very particular set of skills; skills I have acquired over a very long career. Skills that make me a nightmare for people like you. If you accept that i am correct, that'll be the end of it. I will not look for you, I will not pursue you. But if you don't, I will look for you, I will find you, and I will splunk you.

Re: Splunk treats any number that uses E (instead of *10) as a string

markthompson — Fri, 20 Feb 2015 15:45:06 GMT

I Appreciate your quote from Taken, credits to 20th century fox, but in the interest of helping the community, your behaviour on this site should reflect that as such to help the community by upvoting and accepting correct answers so that others who have similar questions can understand.

The down vote is designed to show that an answer is not correct and should probably only be used in rare circumstances where a member of the community is inaccurate in their answer and you believe this could be misleading to any other user.

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:45:39 GMT

Your answer is wrong and thus deserves a down vote... In my opinion I am benefiting the community by allowing other users to easily see that your answer is not a valid response to this question. I accept that we have a difference of opinion, but this is my question and I will not back down. Leave me alone.

Re: Splunk treats any number that uses E (instead of *10) as a string

markthompson — Fri, 20 Feb 2015 15:50:24 GMT

Toby, this answer has been proven by the documentation and thus so should not be down voted. In the interest of the community please remove your down vote or I will be forced to report you for false down voting.

I accept you may see it as an alphanumeric value but alphanumeric is classed as a string in basic programming language, which you will notice once you have completed some training on the subject, Once you have achieved the same amount of gold badges as I have, then please don't hesitate to let me know and then I'll be happy to explain why it's classed as a string.

So, last time, please remove your negative vote, as it might not have been the answer you was looking for, but it is a factually valid answer and can be used in the future by other users

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:50:55 GMT

I have been using splunk since version 0.1... I know how this stuff works. You don't. I will remove your down vote because I feel sorry for you. That is all.

Re: Splunk treats any number that uses E (instead of *10) as a string

markthompson — Fri, 20 Feb 2015 15:54:09 GMT

Toby, thanks for you co-operation and you will be recognised for helping the community, please strive to achieve as many badges as you can, but just out of interest, how comes you only joined Splunk answers in jan 2015?

Re: Splunk treats any number that uses E (instead of *10) as a string

toby6578 — Fri, 20 Feb 2015 15:54:10 GMT

I felt I should give lesser mortals such as yourself a head start when it comes to gaining badges. My fountain of knowledge flows far too strong for simpler minds.