Splunk Search

Convert string to decimal number

Matthias_BY
Communicator

Hello,

i have a field extraction where i have values who are like 21,3

splunk recognizes them as string. but that are temprature data and i like to have tham as decimal numbers so i fan calculate avarage, lines etc.

how can i convert them?
thanks

Tags (1)
0 Karma
1 Solution

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

View solution in original post

Matthias_BY
Communicator

Hi

thanks for the tips. i have found out that the software which writes the machine data (cumulus from sandysoft) is using the decimal delimeter from the regional settings on windows.

i reconfigured on this server to use the dot instead of the comma and now i have my data nice. i'm sure it might have been corrected via props and transform with splunk but that one was the fastest and easiest way.

br
matthias

0 Karma

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...