Splunk Search

How can I tell a field value's type (number or string) just by looking?

Esteemed Legend

I know that I can use the isnum() and isstr() functions but surely there is a more obvious way, right?

Tags (3)
1 Solution

Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

View solution in original post

Path Finder

You can use typeof() function to determine what is type of a field.
More info https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/InformationalFunctions

Esteemed Legend

Also, isnumber.

0 Karma

Esteemed Legend

Actually, I already know the answer because I just discovered it and it is TOO COOL not to share!

If the value has been created as a number, it will show right-justified in the column, but if it has been created as a string, it will show left-justified. HOW COOL IS THAT!!! I wonder how long that has been in Splunk and if it is actually documented anywhere?

View solution in original post

Esteemed Legend

Note that tostring and tonumber are not honored by this convention, which makes me sad.

0 Karma

Esteemed Legend

Also typeof().

0 Karma

Builder

This is such a brilliant little detail you noticed. Thanks!!

0 Karma

Esteemed Legend

Hey @jkjeong why the downvote here? Seriously; is there something amiss that I am totally missing?

0 Karma