Enforcing string field type on digit-only data

[sschuerger]

Hi, I'm working with log data which contains MSISDNs (mobile numbers), which are in the form of "491701234567". It's a CSV-style flatfile log format I'm using.

Doing a search
msisdn=491701234567
does not work (double-quoting also doesn't help). Strangely, using "491701234567" without field name works, but I need field name matches.

Apparently, Splunk stores the MSISDNs in some kind of numerical format where mantissa precision loss is an issue. But MSISDNs are not numbers, they are basically strings with a numerical alphabet (you can't do sensible numerical operations with MSISDNs).

How do I get Splunk to store them in a string field type despite of digit-only content?

Thanks,
Stefan

[woodcock]

You must tell Splunk to treat this field in a special way in $SPLUNK_HOME/etc/system/local/fields.conf:

[msisdn]

INDEXED_VALUE = false

[lguinn2]

I don't know why this is happening, but I do have a work-around.

"491701234567"
| regex msisdn="491701234567"

This should work. This is based on what I think might be wrong here. First, Splunk does not store the field values, so "Splunk stores the MSISDNs in some kind of numerical format" is certainly false. What I think is going wrong is this: In the search command itself, the 491701234567 is converted to a number and tested against the value of the msisdn field. I think that Splunk sees the values in the msisdn field and decides that the field is numeric, so the constant should be as well; this conversion occurs regardless of the quotation marks. This is consistent with other Splunk behavior regarding the automatic detection of numeric fields.

In my example, I first search for the string to reduce the overall number of events that need to be tested. The second command uses a regular expression to do the comparison, so no string-to-numeric conversion will occur.

All that said, I would file a support ticket on this. Your original search really should work.