Splunk Search

Convert a string into a number

Splunk Employee
Splunk Employee

I extracted some values into a field using the field extractor and now I need to convert it into a number to use sum() and avg(). It seems that this field's values is being recognized by Splunk as a string. I saw on the online docs the convert() function, but, not sure how to use it. Could you help?

Thanks a lot.

Tags (1)


I don't think if the field contains only number the arithmetic operations will take them as string, sum / avg should work.

How ever you can also use to convert to number :

isnum() also can be used to check the value if its number or not.

...|Convert num(filed) as Number_Filed also can be used


Super Champion

Try this:

search | convert num(fieldtoconvert)

This should convert the field you want to convert from a string to a number. All non-numbers will be removed. If you want to leave the non-numbers unchanged, then use:

search | convert auto(fieldtoconvert)