topic Re: Convert string to number and compare in Splunk Search

Convert string to number and compare

Rialf1959 — Mon, 23 Oct 2017 08:58:33 GMT

Hello,
why this is not working ?

| gentimes start=-1 | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)" | where ReplicasA > 0

I even tryied this:

| gentimes start=-1 | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)"| eval n=tonumber(ReplicasA) | where n > 0

Thanks

Re: Convert string to number and compare

koshyk — Mon, 23 Oct 2017 09:30:17 GMT

above works for me though. I can see the result is filtered to 3 rows which has n> 0
Which Splunk version you using?

|makeresults | eval WithUnit="0/1 2/2 3/8 0/0 5/5" | makemv WithUnit | table WithUnit | mvexpand WithUnit | rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)"| where ReplicasA < ReplicasB

Re: Convert string to number and compare

niketn — Mon, 23 Oct 2017 09:38:07 GMT

[Updated Answer based on Sample JSON Data]

@Rialf1959, is this a single event or can an event have multiple such nodes? I am trying to understand as to why you were trying to use multivalue field evaluations?

I can see "Replicas":"1/1" in the data is what you might be interested in. If your fields are extracted, your field Replicas should have value 1/1 extracted by default. All you would need to do is

<YourBaseSearch>
 | eval Replicas=split(Replicas,"/")
 | eval ReplicasA=mvindex(Replicas,0)
 | eval ReplicasB=mvindex(Replicas,1)
 | where ReplicasA > 0

Following is a run anywhere search based on your sample data provided herewith to illustrate above code:

|  makeresults
|  eval _raw ="{\"ID\":\"de7zc794qqk1\",\"Image\":\"example.com/test:1.0.1\",\"Mode\":\"replicated\",\"Name\":\"test\",\"Ports\":\"\",\"Replicas\":\"1/1\"}"
|  spath
|  table Replicas
|  eval Replicas=split(Replicas,"/")
|  eval ReplicasA=mvindex(Replicas,0)
|  eval ReplicasB=mvindex(Replicas,1)
|  where ReplicasA > 0

@Rialf1959, try the following (I have tried with space as delimiter for makemv command:

| makeresults 
| eval WithUnit="0/1 2/2 3/8 0/0 5/5"
| makemv WithUnit delim=" "
| mvexpand WithUnit 
| rex field=WithUnit "(?<ReplicasA>\d+)\/(?<ReplicasB>\d+)" 
| where ReplicasA > 0

Or use split() with mvindex instead of rex

| makeresults 
| eval WithUnit="0/1 2/2 3/8 0/0 5/5"
| makemv WithUnit delim=" "
| mvexpand WithUnit 
| eval WithUnit=split(WithUnit ,"/")
| eval ReplicasA=mvindex(WithUnit,0)
| eval ReplicasB=mvindex(WithUnit,1)
| where ReplicasA > 0

Re: Convert string to number and compare

niketn — Mon, 23 Oct 2017 09:39:50 GMT

Just noticed, without delim also makemv command works.

Re: Convert string to number and compare

Rialf1959 — Mon, 23 Oct 2017 10:03:13 GMT

It does now work with my data.

For example:
{"ID":"de7zc794qqk1","Image":"example.com/test:1.0.1","Mode":"replicated","Name":"test","Ports":"","Replicas":"1/1"}

P.S.: I have enabled json indexed extractions. So field are extracted.

Re: Convert string to number and compare

niketn — Mon, 23 Oct 2017 16:26:54 GMT

@Rialf1959, I have updated my answer based on this sample data. However, it is confusing with this data as to why you had multi value field evaluation in your question when the information is already available in field Replicas.