Splunk Search
Highlighted

How to convert the values of multiple fields to number?

Path Finder

Hi All,

Good day!

I just want to ask for some help here. 🙂

I have multiple fields with the data I'm working on with values, "0, 1, 2, 3, 4, 5, NULL".
Ex.
alt text

I replace the "NULL" values and replace it with space, " ", and add all of these fields and put it in a new field with this code:

| replace NULL WITH " " IN "FIELD A" "FIELD B" "FIELD C" "FIELD D" "FIELD E"
| eval newField ="FIELD A" +  " FIELD B" + " FIELD C" + "" FIELD D" + " FIELD E"

But instead of adding the values of the fields, it concatenates it like like this:
alt text

Notice that the events where there was a "NULL" values where seem to be treated as a string.

I tried to use the tonumber() function to convert it to string but it doesn't work.
Ex:

|eval "FIELD A" = tonumber("FIELD A")
|eval "FIELD B" = tonumber("FIELD B")
|eval "FIELD C" = tonumber("FIELD C")
|eval "FIELD D" = tonumber("FIELD D")
|eval "FIELD E" = tonumber("FIELD E")

What could be the possible cause of this issue and what could be the solution?

Thanks! 🙂

Highlighted

Re: How to convert the values of multiple fields to number?

Motivator

Remove double quotes for newfield calculation and try.

0 Karma
Highlighted

Re: How to convert the values of multiple fields to number?

Path Finder

Hi @ansif,

I have also tried it already but it still doesn't work.

0 Karma
Highlighted

Re: How to convert the values of multiple fields to number?

Motivator

Can I get the raw data?

0 Karma
Highlighted

Re: How to convert the values of multiple fields to number?

Path Finder

Hi @ansif,

I'm sorry but I cannot provide the raw data to you. But why do you need it?

0 Karma
Highlighted

Re: How to convert the values of multiple fields to number?

Super Champion

try this:

...|replace NULL with 0|eval newField ='FIELD A' +  'FIELD B' + 'FIELD C' + 'FIELD D' + 'FIELD E'
0 Karma