Splunk Search

How to convert String values into factor variable?

zacksoft
Contributor

I have string fields; an example is "URL".

I want it to convert it to numeric / factor variable to perform statistical calculation.

Example:
Field URL contains values like
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Blunk.com/
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Bplunk.com/
https://answers.Cplunk.com/

It should be converted into 1, 2, 2, 1, 2, 2, 3

(All the 1's are same type of string, 2's are same type string, and same goes with 3)

I hope I explain it correctly.

Tags (1)
0 Karma
1 Solution

damien_chillet
Builder
 | table <your_field>
 | sort <your_field>
 | streamstats dc(<your_field>) as num

Where is the field containing url

View solution in original post

0 Karma

damien_chillet
Builder
 | table <your_field>
 | sort <your_field>
 | streamstats dc(<your_field>) as num

Where is the field containing url

0 Karma

FrankVl
Ultra Champion

Why would you need to convert the URL to a numeric value to be able to perform statistical calculations?

0 Karma

zacksoft
Contributor

I want to know how many times that specific http request is requested and what were the corresponding response times for all those requests ... and some similar other calculation.

0 Karma

FrankVl
Ultra Champion

But that can simply be done by | stats count by url right? No need to convert it to a number first.

0 Karma

zacksoft
Contributor

Thanks Frank. Your suggestion serves the purpose. In @damien_chillet 's suggestion I am able to see the urls and I can add another value next to it , like response time.

Example : If xxx.yyy.zzz is called 4 times , then how much time it took to respond in all those four calls separately. I am able to see it easily.

0 Karma

damien_chillet
Builder

Not sure that will work with your use case, but could you try add the following to your search

| sort <your_field>
| streamstats dc(<your_field>) as num
0 Karma

zacksoft
Contributor

@damien_chillet
As it appears, You Sir have solved my problem.

0 Karma

damien_chillet
Builder

Glad it worked!
I have converted my comment as an answer.
Could you please accept it to close the question?

0 Karma

damien_chillet
Builder

Note: you might want to look at @FrankVI comments, you may well be able to retrieve stats without converting to numeric in the first place (unless what you wanna do is very specific and original 🙂 )

0 Karma

zacksoft
Contributor

I tried it. Not quite sure what it did. I am hoping to see the result in a table format. Then it would be easy for me to see and verify the result.

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...