https://community.splunk.com/t5/Splunk-Search/How-to-get-Splunk-to-evaluate-numbers-without-a-leading-digit/m-p/177440#M51027 <P>Test this</P> <PRE><CODE>sourcetype=access_combined | eval apache_cpu_used_numeric=tonumber(apache_cpu_used) | timechart span=1m sum(apache_cpu_used_numeric) by ServerName </CODE></PRE> <P>If that doesn't work, it may be that the <CODE>tonumber</CODE> function doesn't like the missing 0. Then you can try</P> <PRE><CODE>sourcetype=access_combined | eval apache_cpu_used_numeric=tonumber("0" . apache_cpu_used) | timechart span=1m sum(apache_cpu_used_numeric) by ServerName </CODE></PRE> <P>If you run these searches in Verbose mode, you should be able to see the fields and events even if the timechart doesn't work. Finally, if this solves your problem, you could create a calculated field that makes the numeric conversion for you automatically.</P> Tue, 06 Jan 2015 23:14:48 GMT lguinn2 2015-01-06T23:14:48Z https://community.splunk.com/t5/Splunk-Search/How-to-get-Splunk-to-evaluate-numbers-without-a-leading-digit/m-p/177439#M51026 <P>I have my apache servers' mod_status output (/server-status?auto) being pulled into Splunk with a scripted input. The CPU usage of apache is its own field in the search results as a numeric value. Problem is the apache servers use less that 1% of CPU when things are normal so the data being pulled into Splunk shows up like </P> <UL> <LI>apache_cpu_usage=.078852</LI> <LI>apache_cpu_usage=.03456</LI> <LI>apache_cpu_usage=.11234</LI> </UL> <P>Whenever I run a simple search like:</P> <PRE><CODE>sourcetype=access_combined | timechart span=1m sum(apache_cpu_used) by ServerName </CODE></PRE> <P>I don't get any results in the visualization. Tried changing the Y axis value minimum to be .05 and still nothing. My guess is Splunk doesn't like the 0 missing before the decimal. Since the value will show up when apache uses more than 1% CPU it's correct the way it's being input. What's the best way to get Splunk to evaluate the data with missing leading digits or am I just missing something?</P> Mon, 28 Sep 2020 18:36:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-Splunk-to-evaluate-numbers-without-a-leading-digit/m-p/177439#M51026 DFresh4130 2020-09-28T18:36:02Z https://community.splunk.com/t5/Splunk-Search/How-to-get-Splunk-to-evaluate-numbers-without-a-leading-digit/m-p/177440#M51027 <P>Test this</P> <PRE><CODE>sourcetype=access_combined | eval apache_cpu_used_numeric=tonumber(apache_cpu_used) | timechart span=1m sum(apache_cpu_used_numeric) by ServerName </CODE></PRE> <P>If that doesn't work, it may be that the <CODE>tonumber</CODE> function doesn't like the missing 0. Then you can try</P> <PRE><CODE>sourcetype=access_combined | eval apache_cpu_used_numeric=tonumber("0" . apache_cpu_used) | timechart span=1m sum(apache_cpu_used_numeric) by ServerName </CODE></PRE> <P>If you run these searches in Verbose mode, you should be able to see the fields and events even if the timechart doesn't work. Finally, if this solves your problem, you could create a calculated field that makes the numeric conversion for you automatically.</P> Tue, 06 Jan 2015 23:14:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-Splunk-to-evaluate-numbers-without-a-leading-digit/m-p/177440#M51027 lguinn2 2015-01-06T23:14:48Z