Hi team,
I have "file_size" in my extracted fields and the values are 1.56 KB,5.03 MB, 1.06 B. and those values are strings. I need a query how to convert string to Integer to sum(file_size) i need to use max and min and sum commands for the file_size. Please help me on the same.
Thanks
Here's an example - you need the rex and eval statements
| makeresults
| eval file_size=split("1.56 KB,5.03 MB,1.06 B,1MB,4.95 GB,5.13TB", ",")
| mvexpand file_size
| rex field=file_size "(?<size>\d+(\.\d+)?)\s?(?<mul>\w+)?"
| eval file_size=case(mul="KB", size * 1024,
mul="MB", size * 1024 * 1024,
mul="GB", size * 1024 * 1024 * 1024,
mul="TB", size * 1024 * 1024 * 1024 * 1024,
1==1, size)