Splunk Search

Problems with tonumber convertion - always returns the same value

ChrisLH
Explorer

Hi,

while doing some field comparisons I had problems matching one number field to another. After some research into my data I got the strange phenomena that converting my field to a number always leads to the same result.
My input value is already numerical but if a apply the following search:

sourcetype=systemevents eventTyp=PT0001 | eval number=tonumber(seriennummerZentral) | eval string=tostring(seriennummerZentral) | table seriennummerZentral number string

I get:

seriennummerZentral↕ number↕ string↕

06021001100101011000001492 6021001100101010952552448.000000 06021001100101011000001492
06021001100101011000001492 6021001100101010952552448.000000 06021001100101011000001492
06021001100101011000001492 6021001100101010952552448.000000 06021001100101011000001492
06021001100101011000001487 6021001100101010952552448.000000 06021001100101011000001487
06021001100101011000001487 6021001100101010952552448.000000 06021001100101011000001487
06021001100101011000001451 6021001100101010952552448.000000 06021001100101011000001451
06021001100101011000001487 6021001100101010952552448.000000 06021001100101011000001487
06021001100101011000001451 6021001100101010952552448.000000 06021001100101011000001451
06021001100101011000001487 6021001100101010952552448.000000 06021001100101011000001487
06021001100101011000001451 6021001100101010952552448.000000 06021001100101011000001451
06021001100101011000001487 6021001100101010952552448.000000 06021001100101011000001487
06021001100101011000001487 6021001100101010952552448.000000 06021001100101011000001487

seriennummerZentral is changing as is string but number is always the same

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

I guess that you've hit the limit of integers when converting to number. Do you have any specific need for the conversion?

View solution in original post

ChrisLH
Explorer

yeaa, you're probably right 🙂
and I think the problem was the integer limit.
Thx !

0 Karma

somesoni2
Revered Legend

I believe you won't be doing any numeric operation on the Serial No fields, you should use it as string (with conversion if required).

0 Karma

ChrisLH
Explorer

I wanted to select events by comparing two number fields:
seriennummerZentral seriennummerFzg
with the search statement:

sourcetype=systemevents eventTyp=PT0001 | where seriennummerZentral=seriennummerFzg

and got only positve results no matter the values. I figured it's maybe a problem with data types and tryed converting to number and to string.
| where tostring (seriennummerZentral) = tostring (seriennummerFzg)
is working
| where tonumber (seriennummerZentral) = tonumber (seriennummerFzg)
gives the same results as the initial statement, always true

0 Karma

somesoni2
Revered Legend

I guess that you've hit the limit of integers when converting to number. Do you have any specific need for the conversion?

martin_mueller
SplunkTrust
SplunkTrust

Being slightly pedantic here, but what's actually happening is that 6,021,001,100,101,010,952,552,448 is the most accurate IEEE754 Double representation - for all of your input serial numbers. The small differences between them are beyond what a Double can distinguish.

For comparison, the next bigger Double with no other values between them would be 6,021,001,100,101,012,026,294,272 - about a billion higher.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...