I have string fields; an example is "URL".
I want it to convert it to numeric / factor variable to perform statistical calculation.
Example:
Field URL contains values like
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Blunk.com/
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Bplunk.com/
https://answers.Cplunk.com/
It should be converted into 1, 2, 2, 1, 2, 2, 3
(All the 1's are same type of string, 2's are same type string, and same goes with 3)
I hope I explain it correctly.
| table <your_field>
| sort <your_field>
| streamstats dc(<your_field>) as num
Where is the field containing url
| table <your_field>
| sort <your_field>
| streamstats dc(<your_field>) as num
Where is the field containing url
Why would you need to convert the URL to a numeric value to be able to perform statistical calculations?
I want to know how many times that specific http request is requested and what were the corresponding response times for all those requests ... and some similar other calculation.
But that can simply be done by | stats count by url
right? No need to convert it to a number first.
Thanks Frank. Your suggestion serves the purpose. In @damien_chillet 's suggestion I am able to see the urls and I can add another value next to it , like response time.
Example : If xxx.yyy.zzz is called 4 times , then how much time it took to respond in all those four calls separately. I am able to see it easily.
Not sure that will work with your use case, but could you try add the following to your search
| sort <your_field>
| streamstats dc(<your_field>) as num
@damien_chillet
As it appears, You Sir have solved my problem.
Glad it worked!
I have converted my comment as an answer.
Could you please accept it to close the question?
Note: you might want to look at @FrankVI comments, you may well be able to retrieve stats without converting to numeric in the first place (unless what you wanna do is very specific and original 🙂 )
I tried it. Not quite sure what it did. I am hoping to see the result in a table format. Then it would be easy for me to see and verify the result.