Getting Data In

Why is the Splunk Python SDK not returning formatted numbers in the JSON response?

lpolo
Motivator

Splunk Python SDK does not return formatted numbers in the JSON response.

Example:

|eval var1=tonumber(var2)|
table var1

Results:

[{"var1": "321"}]

I was expecting

[{"var1": 321}]

Any idea why?

Thanks,
Lp

Tags (2)
0 Karma

gwobben
Communicator

I'm not working at Splunk so I can't really answer the why. However, it looks like Splunk is unaware of the data type (which makes sense given that the data type is figured out on search time). I'm guessing this is the reason everything is quoted in the JSON response, to prevent invalid JSON.

It's not very hard to work around this in Python (although there might be a minor performance hit). Try something like this:

def parseDictValues(d):
    for key, value in d.iteritems():

        # Test for a float
        try:
            d[key] = float(value)
        except ValueError:
            pass
    return d

Then loop through the results you've received and call this function to convert all numeric values.

0 Karma

lpolo
Motivator

Splunk should honor that data type in the json response if I specify the data type in the search query.

Thanks,
Lp

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...