Splunk Search

Convert string to decimal number

Matthias_BY
Communicator

Hello,

i have a field extraction where i have values who are like 21,3

splunk recognizes them as string. but that are temprature data and i like to have tham as decimal numbers so i fan calculate avarage, lines etc.

how can i convert them?
thanks

Tags (1)
0 Karma
1 Solution

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

View solution in original post

Matthias_BY
Communicator

Hi

thanks for the tips. i have found out that the software which writes the machine data (cumulus from sandysoft) is using the decimal delimeter from the regional settings on windows.

i reconfigured on this server to use the dot instead of the comma and now i have my data nice. i'm sure it might have been corrected via props and transform with splunk but that one was the fastest and easiest way.

br
matthias

0 Karma

rgcurry
Contributor

It appears that the number formatting used in your region is different from that used in my region. Here where I am (state of Illinois in USofA), that value would be displayed as 21.3 versus what your region and many others in the world who use "," where we use ".".

Have you considered the "charset" parameter in the props.conf file? That might allow Splunk to properly recognize this value as a number instead of a string. Check it out at

http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Propsconf.

Use your browser's search feature to look for either "International" or "charset" to jump right to the info that explains how this works.

*** NOTE *** For those interested in the different ways that numbers are formatted and what retions use what format, check out this web page:

http://www.codeproject.com/Articles/78175/International-Number-Formats

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...