Splunk Search

How can I tell a field value's type (number or string) just by looking?

woodcock
Esteemed Legend

I know that I can use the isnum() and isstr() functions but surely there is a more obvious way, right?

Tags (3)
1 Solution

woodcock
Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

View solution in original post

ferdydek
Path Finder

You can use typeof() function to determine what is type of a field.
More info https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/InformationalFunctions

woodcock
Esteemed Legend

Also, isnumber.

0 Karma

woodcock
Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

woodcock
Esteemed Legend

Note that tostring and tonumber are not honored by this convention, which makes me sad.

woodcock
Esteemed Legend

Also typeof().

0 Karma

_smp_
Builder

This is such a brilliant little detail you noticed. Thanks!!

0 Karma

woodcock
Esteemed Legend

Hey @jkjeong why the downvote here? Seriously; is there something amiss that I am totally missing?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...