I have a csv file that is created by a shell script on a Linux server and runs every minute. I am running a forwarder on the server to send the data to splunk. The csv file has a header line containing the field names. Some of the data has units along with the number. What I mean is if the number is a percent, the number might look like "10%". If a number is measured in microseconds, the number might look like "10us". Is that the best way to ingest the data? Should I remove the units? Does Splunk see "10us" as a number? Thanks!
Splunk will interpret "10us" as a string because it contains characters that don't belong in a number (sign, digits, decimal separator). To ensure Splunk treats numbers as numbers, remove any units before ingestion, if possible.
--- If this reply helps you, Karma would be appreciated.