topic Re: Why are fields returning true for both isNum() and isStr() ? in Splunk Search

Why are fields returning true for both isNum() and isStr() ?

rolaso — Mon, 28 Sep 2020 17:54:18 GMT

Hi,

I want to setup a search to alarm me if a field ever changes its nature. To play around, I chose the year field in one of our indexes. This field appears to be numeric.

field k="date_year" c="20" nc="20" dc="1" exact="1" relevant="0"

All 20 counts are numeric, hence it should be numeric.

I would expect this simple search to have isNum=true and isStr=false for all fields:

index=foo
| eval isStr= if(isstr(date_year),"true","false")
| eval isNum= if(isnum(date_year),"true","false")
| table isNum,isStr, date_year

But this is what I get:

isNum isStr date_year
true true 2014
true true 2014
true true 2014

I have done some research, and I can't find any posts about this behaviour. Can someone explain to me why this is happening?

Many thanks!

Re: Why are fields returning true for both isNum() and isStr() ?

ppablo — Mon, 28 Sep 2020 17:54:33 GMT

Hi @rolaso

I think the reason isStr is returning "true" is because numeric values are also considered strings. I was just looking through Splunk documentation and found this:

"Numbers, for example, are strings that contain the number. For example, a field containing a value of the number 10 contains the characters 1 and 0: "10""

The date_year field will always be a number, so 2014 could be seen as containing the characters 2, 0, 1, 4: "2014", so it makes sense that | eval isStr= if(isstr(date_year),"true","false") would return "true".

Re: Why are fields returning true for both isNum() and isStr() ?

rolaso — Mon, 20 Oct 2014 04:21:09 GMT

Thank you for your reply, it makes perfect sense.

Re: Why are fields returning true for both isNum() and isStr() ?

ppablo — Mon, 20 Oct 2014 04:27:37 GMT

No problem @rolaso glad I could clarify.

Re: Why are fields returning true for both isNum() and isStr() ?

Nikobobinus — Mon, 03 Dec 2018 10:57:10 GMT

Under which scenarios does isstr return false then other than empty/null?

Re: Why are fields returning true for both isNum() and isStr() ?

weidertc — Mon, 27 Jul 2020 21:36:16 GMT

Is this a claim that isnum() and isstr() are deprecated? This was working up until recently. I've been scratching my head for hours trying to fix my dashboard.

If this is the case then there needs to be a way to find out if a string containing only numbers is indeed only numbers.