Splunk Search

How to convert String values into factor variable?

zacksoft
Contributor

I have string fields; an example is "URL".

I want it to convert it to numeric / factor variable to perform statistical calculation.

Example:
Field URL contains values like
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Blunk.com/
https://answers.Aplunk.com/
https://answers.Bplunk.com/
https://answers.Bplunk.com/
https://answers.Cplunk.com/

It should be converted into 1, 2, 2, 1, 2, 2, 3

(All the 1's are same type of string, 2's are same type string, and same goes with 3)

I hope I explain it correctly.

Tags (1)
0 Karma
1 Solution

damien_chillet
Builder
 | table <your_field>
 | sort <your_field>
 | streamstats dc(<your_field>) as num

Where is the field containing url

View solution in original post

0 Karma

damien_chillet
Builder
 | table <your_field>
 | sort <your_field>
 | streamstats dc(<your_field>) as num

Where is the field containing url

0 Karma

FrankVl
Ultra Champion

Why would you need to convert the URL to a numeric value to be able to perform statistical calculations?

0 Karma

zacksoft
Contributor

I want to know how many times that specific http request is requested and what were the corresponding response times for all those requests ... and some similar other calculation.

0 Karma

FrankVl
Ultra Champion

But that can simply be done by | stats count by url right? No need to convert it to a number first.

0 Karma

zacksoft
Contributor

Thanks Frank. Your suggestion serves the purpose. In @damien_chillet 's suggestion I am able to see the urls and I can add another value next to it , like response time.

Example : If xxx.yyy.zzz is called 4 times , then how much time it took to respond in all those four calls separately. I am able to see it easily.

0 Karma

damien_chillet
Builder

Not sure that will work with your use case, but could you try add the following to your search

| sort <your_field>
| streamstats dc(<your_field>) as num
0 Karma

zacksoft
Contributor

@damien_chillet
As it appears, You Sir have solved my problem.

0 Karma

damien_chillet
Builder

Glad it worked!
I have converted my comment as an answer.
Could you please accept it to close the question?

0 Karma

damien_chillet
Builder

Note: you might want to look at @FrankVI comments, you may well be able to retrieve stats without converting to numeric in the first place (unless what you wanna do is very specific and original 🙂 )

0 Karma

zacksoft
Contributor

I tried it. Not quite sure what it did. I am hoping to see the result in a table format. Then it would be easy for me to see and verify the result.

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...