topic How to sum numbers with commas in Splunk Search

How to sum numbers with commas

rksubbu — Mon, 19 Dec 2011 16:39:29 GMT

I would like to calculate the total for the following sample. These are numbers but have comma.

My query looks like this and the values appear in DEL_JOBS

... | rex field=_raw  "Total Jobs Deleted: (?<DEL_JOBS>.*)"

I was trying isnumber("X",Y), but I get this

[EventsViewer module] Error in 'eval'
command: The 'tonumber' function is
unsupported.

What would be the best way to do this simple arithmetic?
Thanks.

Re: How to sum numbers with commas

dwaddle — Mon, 19 Dec 2011 16:58:20 GMT

Maybe not the best but one that works quickly and easily is to use rex's sed mode to strip off the commas:

... | rex field=_raw  "Total Jobs Deleted: (?<DEL_JOBS>.*)"
| rex field=DEL_JOBS mode=sed "s/,//g"

I just noticed that the convert command has an rmcomma operation. So, this is probably the BEST way to do it.

... | rex field=_raw  "Total Jobs Deleted: (?<DEL_JOBS>.*)" | convert rmcomma(DEL_JOBS)

Re: How to sum numbers with commas

joshd — Mon, 19 Dec 2011 17:03:06 GMT

why not use replace on every occurrence of a comma then perform your calculations on the new field?

ie. | eval amount=replace(DEL_JOBS, ",", "")

Re: How to sum numbers with commas

rksubbu — Mon, 19 Dec 2011 19:10:20 GMT

Thanks for the answer. Worked great!

Re: How to sum numbers with commas

rksubbu — Mon, 19 Dec 2011 19:11:39 GMT

This also worked great. But, I am marking the first answer as accepted because it came in earlier and it was one field less. 🙂

Thanks for the answer. Appreciate it.

Re: How to sum numbers with commas

rksubbu — Mon, 19 Dec 2011 19:12:31 GMT

This was the query I used.

...| rex field=_raw  "Total Jobs Deleted: (?<DEL_JOBS>.*)" | rex field=DEL_JOBS mode=sed "s/,//g" | stats sum(DEL_JOBS) as Total_Jobs_Deleted

Re: How to sum numbers with commas

joshd — Mon, 28 Sep 2020 10:14:23 GMT

Agree with you totally! I actually read your question wrong initially and thought you had commas where you wanted periods, hence why I immediately recommended the replace command then revised the usage of it, dwaddle beat me to the punch with sed, figured Id leave mine as an option anyhow 🙂 You also dont have to create a new field you can do: eval DEL_JOBS=replace(DEL_JOBS, ",","")