Splunk Search

Convert string to decimal number

Matthias_BY
Communicator

Hello,

i have a field extraction where i have values who are like 21,3

splunk recognizes them as string. but that are temprature data and i like to have tham as decimal numbers so i fan calculate avarage, lines etc.

how can i convert them?
thanks

Tags (1)
0 Karma
1 Solution

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

View solution in original post

Matthias_BY
Communicator

Hi

thanks for the tips. i have found out that the software which writes the machine data (cumulus from sandysoft) is using the decimal delimeter from the regional settings on windows.

i reconfigured on this server to use the dot instead of the comma and now i have my data nice. i'm sure it might have been corrected via props and transform with splunk but that one was the fastest and easiest way.

br
matthias

0 Karma

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...