Splunk Enterprise

xml: Check if a value is a number

weidertc
Communicator

I need to check of the time tokens are numeric.  I used to use this and it worked, but suddenly my dashboard broke.

 

I initially had this inside my time selector filter, and it worked, until today.

<eval token="anumber">if(isnum('earliest'),"true","false")</eval>

 

I also tried this, but it didn't work.

<eval token="number">if(match('earliest',"^\d+"),"true","false")</eval>

 

It keeps evaluating to false.

I get how a string to contain only numbers and it'd be a string, but this actually worked earlier.  How can I check whether a number or a string containing only numbers (and a decimal) to actually return true?

Labels (1)
Tags (3)

BernardEAI
Communicator

@weidertc I'm seeing the same thing. It used to work for me as well, now it has stopped working. We upgraded to Splunk 8.1.0 from Splunk 7 recently, it might have something to do with this..?

 

UPDATE:

I described the approach I took to address this here: https://community.splunk.com/t5/Splunk-Search/Convert-timepicker-token-to-epoch-time-for-eval-regard... 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...