Splunk Search

How to typecast integer to string and save that to a new field?

DEAD_BEEF
Builder

I have a numeric field that needs to be string to put be CIM compliant. I tried using tostring, but it still shows up with the # in the interesting field list so it's still being read as a number. Also, how do I go about saving that field so it is always returned as a string to be used by the data model?

alt text

currently numeric field called

id
values      102342,23482,23498,23490

I want string field

id_string
values      102342,23482,23498,23490
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...