Splunk Search

## Splunk treats any number that uses E (instead of *10) as a string

Path Finder

Any number such as 1.23456E-3 (equivalent to 1.23456*10^-3 or 0.00123456) is recognised by splunk as a string rather than it either converting it to only contain numbers or knowing that E is equivalent to *10. Just wondering if there is a simple way of getting splunk to change this?

Tags (2)
1 Solution
Builder

Here's an answer for you.

If your number contains E, Splunk will recognise it as a string and will allow you to do maths with it, but not plot it on a graph, To fix this, you can multiply the field by 1 or 10 to the power of 0 (1) which will give you the actual number and this can be plotted onto a graph

Builder

Here's an answer for you.

If your number contains E, Splunk will recognise it as a string and will allow you to do maths with it, but not plot it on a graph, To fix this, you can multiply the field by 1 or 10 to the power of 0 (1) which will give you the actual number and this can be plotted onto a graph

Splunk Employee

cackle you guys know each other, right? if not, you should definitely go and get a cup of really HOT tea and sort things out like gentlemen 🙂

Builder

@piebob - Yes we work closely together. mainly in regard to creating Splunk dashboards and views to be used within our company.

In actual fact, he's about a 1 min walk NW from my desk, to his. 😛

Path Finder

Hi Mark,
Thanks for your answer, but Splunk does recognize it as a number and thus you are incorrect.

Builder

Hi Toby,
Going by the definition of a "Number": a quantity or amount.

Hence making your field an alphanumeric value, which is recognised as a string.

Please remove your negative vote, as technically it is a valid answer.

Path Finder

Maths would not be possible if it were a string. Please could you remove your answer as it is clearly invalid.

Builder

Toby, I appreciate that Splunk allows you to do maths with the E in there.
But by Documentation of the Eval command (http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Eval)

Maths will be done with any Alphanumeric field (Does not need to be a Number), it will only error in the event it is a Non-Alphanumeric Field.

Path Finder

Normally I would agree, however I believe in this case E is not recognised as a letter, but as its actual scientific meaning, which is *10^. If you wish to escalate this matter further we should arrange a place to meet and sort out our differences like real men, in the form of street countdown.

Builder

HI Toby, Documentation is based on how the coding behind Splunk works, in the event you wish to argue this, please contact Splunk support (support@splunk.com) who i'm sure will be able to clarify why this works for you, or if you believe their documentation is wrong, be able to discuss it.

There is no room for disagreement and as such please remove your negative vote as it does not contribute to the community as they may believe it's not a correct answer, when in actual fact, it's factually correct.

Path Finder

I will definitely email them later, but not to ask... To prove that I, Toby6578, am correct in this instance (and all others). I don't know who you are. I don't know what you want. If you are looking for badges, I can tell you I don't have karma. But what I do have are a very particular set of skills; skills I have acquired over a very long career. Skills that make me a nightmare for people like you. If you accept that i am correct, that'll be the end of it. I will not look for you, I will not pursue you. But if you don't, I will look for you, I will find you, and I will splunk you.

Splunk Employee

this is the best thing ever.

Builder

I Appreciate your quote from Taken, credits to 20th century fox, but in the interest of helping the community, your behaviour on this site should reflect that as such to help the community by upvoting and accepting correct answers so that others who have similar questions can understand.

The down vote is designed to show that an answer is not correct and should probably only be used in rare circumstances where a member of the community is inaccurate in their answer and you believe this could be misleading to any other user.

Path Finder

Your answer is wrong and thus deserves a down vote... In my opinion I am benefiting the community by allowing other users to easily see that your answer is not a valid response to this question. I accept that we have a difference of opinion, but this is my question and I will not back down. Leave me alone.

Builder

Toby, this answer has been proven by the documentation and thus so should not be down voted. In the interest of the community please remove your down vote or I will be forced to report you for false down voting.

I accept you may see it as an alphanumeric value but alphanumeric is classed as a string in basic programming language, which you will notice once you have completed some training on the subject, Once you have achieved the same amount of gold badges as I have, then please don't hesitate to let me know and then I'll be happy to explain why it's classed as a string.

So, last time, please remove your negative vote, as it might not have been the answer you was looking for, but it is a factually valid answer and can be used in the future by other users

Path Finder

I have been using splunk since version 0.1... I know how this stuff works. You don't. I will remove your down vote because I feel sorry for you. That is all.

Builder

Toby, thanks for you co-operation and you will be recognised for helping the community, please strive to achieve as many badges as you can, but just out of interest, how comes you only joined Splunk answers in jan 2015?

Path Finder

I felt I should give lesser mortals such as yourself a head start when it comes to gaining badges. My fountain of knowledge flows far too strong for simpler minds.

Builder

Thanks for your concern, but in the interest of simplicity, lets stop this argument as it's no longer required and will not be an advantage to users, the fact is no answers have been unnecessarily down voted.

Anyway, good question I must say, I had the same issue on my dashboard. Similar numbers too.

Path Finder

For more information on street countdown, watch The IT Crowd

Path Finder

I have discovered that in fact splunk does know this is a number however it refuses to plot anything containing "E" on a graph, which is even more strange, but that's another question. You can do maths with a number containing E on splunk.

Get Updates on the Splunk Community!

#### Optimize Cloud Monitoring

TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

#### What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

#### Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...