Splunk Search

How to convert the values of multiple fields to number?

jvmerilla
Path Finder

Hi All,

Good day!

I just want to ask for some help here. 🙂

I have multiple fields with the data I'm working on with values, "0, 1, 2, 3, 4, 5, NULL".
Ex.
alt text

I replace the "NULL" values and replace it with space, " ", and add all of these fields and put it in a new field with this code:

| replace NULL WITH " " IN "FIELD A" "FIELD B" "FIELD C" "FIELD D" "FIELD E"
| eval newField ="FIELD A" +  " FIELD B" + " FIELD C" + "" FIELD D" + " FIELD E"

But instead of adding the values of the fields, it concatenates it like like this:
alt text

Notice that the events where there was a "NULL" values where seem to be treated as a string.

I tried to use the tonumber() function to convert it to string but it doesn't work.
Ex:

|eval "FIELD A" = tonumber("FIELD A")
|eval "FIELD B" = tonumber("FIELD B")
|eval "FIELD C" = tonumber("FIELD C")
|eval "FIELD D" = tonumber("FIELD D")
|eval "FIELD E" = tonumber("FIELD E")

What could be the possible cause of this issue and what could be the solution?

Thanks! 🙂

493669
Super Champion

try this:

...|replace NULL with 0|eval newField ='FIELD A' +  'FIELD B' + 'FIELD C' + 'FIELD D' + 'FIELD E'
0 Karma

ansif
Motivator

Remove double quotes for newfield calculation and try.

0 Karma

jvmerilla
Path Finder

Hi @ansif,

I have also tried it already but it still doesn't work.

0 Karma

ansif
Motivator

Can I get the raw data?

0 Karma

jvmerilla
Path Finder

Hi @ansif,

I'm sorry but I cannot provide the raw data to you. But why do you need it?

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...