Splunk Search

Decimal : how to use "," vs "." ?

Explorer

Folks :

I have a customer using numbers in "spanish" standard (a number in the US Standard like 1,000,000.25 is represented in logs as 1.000.000,25)

How can I change that at search time ? Is it possible ?

I have tried to use "eval nn=tonumber(variable) but it can't convert a number in the format before mentioned (1.000.000,25)

Cheers
Arturo

Influencer

It's probably better to eliminate the separating dots before replacing commas.

... | eval nn=tonumber(replace(replace(variable,"\.",""),",",".")) | ...

Influencer

No, not atm.

0 Karma

Explorer

Is that locale-aware "string-to-number" convertion option available ?

Any pointers ?

0 Karma

Influencer

Transforming something like this at index time is probably a bad idea. Even the field extraction happen at search time. An enhancement that might be useful is a locale-aware string-to-number conversion for eval.

0 Karma

Explorer

Thanks guys !!!!!! ... great ideas indeed !!!!!!!!!!!

Question : are there any "permanent/faster" ways to make this "standard" for numeric quantities the "standard" for a customer installation ?

I was thinking that something Just like http://www.splunk.com/base/Documentation/latest/Admin/Configurecharactersetencoding should exist "built in" in Splunk to make him aware of other standards ... maybe at index time ?

Cheers

0 Karma

Splunk Employee
Splunk Employee

There is probably a more elegant way, but:

...| eval var = replace(var, ",", ".") | eval var = replace(var, "\.([^\.]+)$", ",\1")

It would probably be easiest to make this in to a macro for reuse.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!