Splunk ignores and truncates thousand separator commas in automatically identified numeric field

[adi2ky]

We have splunk spit out log statements like latency=1,840 . Splunk identifies latency = 1 latency=524 . Splunk identifies latency = 524

Splunk identitfies latency as Numeric but takes value only as 1 and truncates the other decimal values for case 1. And so the timechart over its average also gets affected. I was hoping to use "convert rmcomma" but that didn't help as the latency field has already been stripped of numbers and commas before supplying to convert rmcomma.

Same question asked by me at : http://stackoverflow.com/questions/29855323/splunk-ignores-and-truncates-thousand-separator-commas-i...

[lguinn2]

Question: "We have splunk spit out log statements" - what does this mean? Where is the information coming from?

I think Splunk is seeing the comma as identifying a "multi-valued field". A Splunk administrator could change how this is parsed, but not without answering my earlier question.

Do this within your search to fix the problem:

yoursearchhere
| eval latency=if(mvcount(latency)>1,mvjoin(latency, ""),latency)
| whateverelse