Splunk Search

How to convert String values into factor variable?

zacksoft
Contributor

I have string fields; an example is "URL".

I want it to convert it to numeric / factor variable to perform statistical calculation.

Example:
Field URL contains values like
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Blunk.com/
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Bplunk.com/
https://answers.Cplunk.com/

It should be converted into 1, 2, 2, 1, 2, 2, 3

(All the 1's are same type of string, 2's are same type string, and same goes with 3)

I hope I explain it correctly.

Tags (1)
0 Karma
1 Solution

damien_chillet
Builder
 | table <your_field>
 | sort <your_field>
 | streamstats dc(<your_field>) as num

Where is the field containing url

View solution in original post

0 Karma

damien_chillet
Builder
 | table <your_field>
 | sort <your_field>
 | streamstats dc(<your_field>) as num

Where is the field containing url

0 Karma

FrankVl
Ultra Champion

Why would you need to convert the URL to a numeric value to be able to perform statistical calculations?

0 Karma

zacksoft
Contributor

I want to know how many times that specific http request is requested and what were the corresponding response times for all those requests ... and some similar other calculation.

0 Karma

FrankVl
Ultra Champion

But that can simply be done by | stats count by url right? No need to convert it to a number first.

0 Karma

zacksoft
Contributor

Thanks Frank. Your suggestion serves the purpose. In @damien_chillet 's suggestion I am able to see the urls and I can add another value next to it , like response time.

Example : If xxx.yyy.zzz is called 4 times , then how much time it took to respond in all those four calls separately. I am able to see it easily.

0 Karma

damien_chillet
Builder

Not sure that will work with your use case, but could you try add the following to your search

| sort <your_field>
| streamstats dc(<your_field>) as num
0 Karma

zacksoft
Contributor

@damien_chillet
As it appears, You Sir have solved my problem.

0 Karma

damien_chillet
Builder

Glad it worked!
I have converted my comment as an answer.
Could you please accept it to close the question?

0 Karma

damien_chillet
Builder

Note: you might want to look at @FrankVI comments, you may well be able to retrieve stats without converting to numeric in the first place (unless what you wanna do is very specific and original 🙂 )

0 Karma

zacksoft
Contributor

I tried it. Not quite sure what it did. I am hoping to see the result in a table format. Then it would be easy for me to see and verify the result.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...