Splunk and localization of numbers

[martindalum]

I'm currently loading some localized CSV-files into Splunk which contains numbers formatted in a localized format (comma instead of period as decimal separator and period instead of comma as thousands separator). This format is used commonly in many countries.

Are there any plans for implementing support for setting locales for inputs/sourcetypes like you can set a charset in props.conf? It would be nice if Splunk could interpret 1.234.567,89 as the same numeric value as 1,234,567.89 without having to transform the data prior to feeding it to Splunk. Currently Splunk interprets "1.234.567,89" as a string.

Ideally numbers could be localized when presented depending on a language setting. However that's a bit extensive 🙂

[rturk]

Hi Martin,

After a bit of a search, it turns out that Splunk provides for this, however just not in a pretty GUI.

Have a look here: http://docs.splunk.com/Documentation/Splunk/latest/Developer/TranslateSplunk#Localize_dates_and_numb...

Hope this helps 🙂

EDIT: Just as I clicked away, I think I just got what you were after. What if I had a file that was created by a system that used a decimal comma for localisation and I wanted to index & report on that along with files created in places that used a decimal point. Being able to specify the number localisation by host/source/sourcetype would be quite useful for this kind of scenario.