Convert Multivalue field into Number

[matthaeus]

Hey there,

I have extracted chart data from the raw field into multivalue fields. But I can't chart the data since splunk doesn't recoginse the the fields as numbers.

x_axis	y_axis
-1.292015 -1.282425 -1.27523 -1.26725 -1.258461 -1.248871	4.9024 5.129161 5.200173 5.327875 5.909696 6.406182

I have tried to convert it using:

|eval x_axis2=tonumber(trim(x_axis))

or:

| Convert num(x_axis)

but both didn't work. Could anybody help me out here?

[thambisetty]

add below search to your search

| eval x_axis=split(x_axis,","),y_axis=split(y_axis,",")
| eval combine=mvzip(x_axis,y_axis)
| fields - x_axis,y_axis
| mvexpand combine
| eval x_axis=mvindex(split(combine,","),0),y_axis=mvindex(split(combine,","),1)
| fields - combine
| table x_axis y_axis

below will create sample events as well and show your results:

| makeresults | eval x_axis="-1.292015,-1.282425,-1.27523,-1.26725,-1.258461,-1.248871",y_axis="4.9024,5.129161,5.200173,5.327875,5.909696,6.406182"
| eval x_axis=split(x_axis,","),y_axis=split(y_axis,",")
| eval combine=mvzip(x_axis,y_axis)
| fields - x_axis,y_axis
| mvexpand combine
| eval x_axis=mvindex(split(combine,","),0),y_axis=mvindex(split(combine,","),1)
| fields - combine
| table x_axis y_axis

[matthaeus]

Thanks so much for your suggested solution, but for some reason I already don't have any results after the first line:

| eval x_axis=split(x_axis,","),y_axis=split(y_axis,",")

[ITWhisperer]

Can you extract the x-axis and y-axis values into separate event rather than multi-value fields? if not, you could mvzip them together with a suitable delimiter, then mvexpand to get separate events. Then split the field and re-evaluate x-axis and y-axis. Then you will have something to chart.

[matthaeus]

So I think I actually don't have a multivalue field, splunk just recognises it as one since it sees the "." as a delimiter rather than a comma.

[matthaeus]

How exactly do you mean?

So I have extracted it using:

| rex field=_raw max_match=0 (?<x_axis>.\d.\d+);(?<y_axis>\d+.\d+)

Sorry, I'm quite new to splunk 😀

[matthaeus]

Hmm.. it just gives me the error message: Error in 'eval' command: The 'mvmap' function is unsupported or undefined. 

[ITWhisperer]

Which version of splunk are you running?

[matthaeus]

Splunk Enterprise

Version:7.2.10

[ITWhisperer]

Try this:

| eval x_axis=mvmap(x_axis, tonumber(x_axis))
| eval y_axis=mvmap(y_axis, tonumber(y_axis))