Splunk Search

How can I tell a field value's type (number or string) just by looking?

woodcock
Esteemed Legend

I know that I can use the isnum() and isstr() functions but surely there is a more obvious way, right?

Tags (3)
1 Solution

woodcock
Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

View solution in original post

ferdydek
Path Finder

You can use typeof() function to determine what is type of a field.
More info https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/InformationalFunctions

woodcock
Esteemed Legend

Also, isnumber.

0 Karma

woodcock
Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

View solution in original post

woodcock
Esteemed Legend

Note that tostring and tonumber are not honored by this convention, which makes me sad.

0 Karma

woodcock
Esteemed Legend

Also typeof().

0 Karma

_smp_
Builder

This is such a brilliant little detail you noticed. Thanks!!

0 Karma

woodcock
Esteemed Legend

Hey @jkjeong why the downvote here? Seriously; is there something amiss that I am totally missing?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!