Splunk Enterprise Security

How to convert String to Integer search?

umesh
Path Finder

Hi team,

I have "file_size" in my  extracted fields and the values are 1.56 KB,5.03 MB, 1.06 B. and those values are strings. I need a query how to convert string to Integer to sum(file_size)  i need to use max and min and sum commands for the file_size. Please help me on the same.

 

Thanks

Tags (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's an example - you need the rex and eval statements

| makeresults
| eval file_size=split("1.56 KB,5.03 MB,1.06 B,1MB,4.95 GB,5.13TB", ",")
| mvexpand file_size
| rex field=file_size "(?<size>\d+(\.\d+)?)\s?(?<mul>\w+)?"
| eval file_size=case(mul="KB", size * 1024, 
                      mul="MB", size * 1024 * 1024, 
                      mul="GB", size * 1024 * 1024 * 1024, 
                      mul="TB", size * 1024 * 1024 * 1024 * 1024,
                      1==1, size)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...