Splunk Search

Convert string to decimal number

Matthias_BY
Communicator

Hello,

i have a field extraction where i have values who are like 21,3

splunk recognizes them as string. but that are temprature data and i like to have tham as decimal numbers so i fan calculate avarage, lines etc.

how can i convert them?
thanks

Tags (1)
0 Karma
1 Solution

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

View solution in original post

Matthias_BY
Communicator

Hi

thanks for the tips. i have found out that the software which writes the machine data (cumulus from sandysoft) is using the decimal delimeter from the regional settings on windows.

i reconfigured on this server to use the dot instead of the comma and now i have my data nice. i'm sure it might have been corrected via props and transform with splunk but that one was the fastest and easiest way.

br
matthias

0 Karma

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...