topic Re: How to convert this string to a numeric value? in Splunk Search

How to convert this string to a numeric value?

abutler1 — Thu, 14 Jul 2016 19:04:52 GMT

I've created a new field, however, it's appearing as a string instead of a value. I've used the regular expression to extract from the following data:

(?=[^T]*(?:Transfer complete.|T.*Transfer complete.))^[^\.\n]*\.\s+(?P\d+,\d+)

Transfer complete. 1,011 bytes transferred

Therefore building a result of 1,011, however, this is considered a string rather than a numeric value. How can I convert this to treat the result as a numeric value?

Re: How to convert this string to a numeric value?

sundareshr — Thu, 14 Jul 2016 19:15:07 GMT

Like this

| gentimes start=-1 | eval x="Transfer complete. 1,011 bytes transferred" | rex field=x "complete\.\s?(?<b>[^\s]+)" | table b | convert num(b) as bn

Re: How to convert this string to a numeric value?

abutler1 — Fri, 15 Jul 2016 11:40:56 GMT

Apoliges, im a newbie at this and entered the above into the regular expression
it's providing null as a result, the value of bytes transferred will range from line to line

Original Source Line

[21] Thu 14Jul16 14:17:15 - (014058) 226 Transfer complete. 1,011 bytes transferred. 30.85 KB/sec.

Result was null

Re: How to convert this string to a numeric value?

sundareshr — Fri, 15 Jul 2016 16:03:23 GMT

As long as the bytes is has complete. before it, this regex will capture all combinations. So you search will look like this

... | rex field=x "complete\.\s?(?<bytes>[^\s]+)\sbytes" | convert num(bytes) as bytes

Re: How to convert this string to a numeric value?

somesoni2 — Fri, 15 Jul 2016 16:32:17 GMT

You can use your original regex and add the convert command as specified in the answer.