Building for the Splunk Platform

Perform numerical calculations on field containing numbers with $ sign

New Member

Hi all,

new to splunk so apologise for such a simple question.

I have a field called "options.deposit.amount" containing deposit amounts that Splunk is treating as string because value is preceded by $ sign. I'd like to be able to convert to numeric values so that I can perform calculations but am having trouble.

Data comes in the format of $XX.xx with no commas or spaces.

I have tried this with no success: search| eval Dep_Amt = substr(options.deposit.amount,2)

Any help with be greatly appreciated.


Tags (1)
0 Karma

Ultra Champion

hello there,

many ways to go about this one. here is an example with rex command:
run this search anywhere and apply

  | makeresults count=1
    | eval options.deposit.amount = "$100.01,$101.02,$12.90"
    | makemv delim="," options.deposit.amount
    | mvexpand options.deposit.amount
    | rex field=options.deposit.amount "\$(?<money>\d+.\d+)"
    | eventstats sum(money) as total

hope it helps

@mcastino, here are two more options:

1) Using replace() eval function

| eval options.deposit.amount_replace=replace('options.deposit.amount',"^\$","")

1) Using substr() eval function

| eval options.deposit.amount_substr=substr('options.deposit.amount',2,len('options.deposit.amount'))
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...