I have a field called "windows_event_id" which contains integer values that I am adding to a table.
I am certain that the data type is number because I have enforced it using | convert num(windows_event_id),
and the values are right-aligned in the resulting table column (nifty that Splunk does this).
I also added an "if" condition in an eval statement which checks if the values are a number format - and they all are, as expected. However, when I export the resulting table in JSON format the values for windows_event_id are wrapped in double quotes.
It seems when exporting in JSON format that ALL fields, regardless of data type, in the table are wrapped in double quotes and therefore treated as strings.
Some sample output from the export:
... "windows_event_id":"4688" ...
I would like for the export to treat this field as a number, rather than a string in the output.
Is this something that must be changed in a .conf file on the administration side, or can this be fixed within the search itself?
This is specifically the type of output that I want:
... "windows_event_id":4688 ...
Thank you.
