Splunk Enterprise

xml: Check if a value is a number

weidertc
Contributor

I need to check of the time tokens are numeric.  I used to use this and it worked, but suddenly my dashboard broke.

 

I initially had this inside my time selector filter, and it worked, until today.

<eval token="anumber">if(isnum('earliest'),"true","false")</eval>

 

I also tried this, but it didn't work.

<eval token="number">if(match('earliest',"^\d+"),"true","false")</eval>

 

It keeps evaluating to false.

I get how a string to contain only numbers and it'd be a string, but this actually worked earlier.  How can I check whether a number or a string containing only numbers (and a decimal) to actually return true?

Labels (1)
Tags (3)

BernardEAI
Communicator

@weidertc I'm seeing the same thing. It used to work for me as well, now it has stopped working. We upgraded to Splunk 8.1.0 from Splunk 7 recently, it might have something to do with this..?

 

UPDATE:

I described the approach I took to address this here: https://community.splunk.com/t5/Splunk-Search/Convert-timepicker-token-to-epoch-time-for-eval-regard... 

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...