I extracted some values into a field using the field extractor and now I need to convert it into a number to use sum() and avg(). It seems that this field's values is being recognized by Splunk as a string. I saw on the online docs the convert() function, but, not sure how to use it. Could you help?
Thanks a lot.
Hello,
I don't think if the field contains only number the arithmetic operations will take them as string, sum / avg should work.
How ever you can also use to convert to number :
tonumber()
isnum() also can be used to check the value if its number or not.
...|Convert num(filed) as Number_Filed also can be used
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonEvalFunctions
Try this:
search | convert num(fieldtoconvert)
This should convert the field you want to convert from a string to a number. All non-numbers will be removed. If you want to leave the non-numbers unchanged, then use:
search | convert auto(fieldtoconvert)