Splunk Search

Splunk treats any number that uses E (instead of *10) as a string

toby6578
Path Finder

Any number such as 1.23456E-3 (equivalent to 1.23456*10^-3 or 0.00123456) is recognised by splunk as a string rather than it either converting it to only contain numbers or knowing that E is equivalent to *10. Just wondering if there is a simple way of getting splunk to change this?

Tags (2)
1 Solution

markthompson
Builder

Here's an answer for you.

If your number contains E, Splunk will recognise it as a string and will allow you to do maths with it, but not plot it on a graph, To fix this, you can multiply the field by 1 or 10 to the power of 0 (1) which will give you the actual number and this can be plotted onto a graph

View solution in original post

markthompson
Builder

Here's an answer for you.

If your number contains E, Splunk will recognise it as a string and will allow you to do maths with it, but not plot it on a graph, To fix this, you can multiply the field by 1 or 10 to the power of 0 (1) which will give you the actual number and this can be plotted onto a graph

piebob
Splunk Employee
Splunk Employee

cackle you guys know each other, right? if not, you should definitely go and get a cup of really HOT tea and sort things out like gentlemen 🙂

markthompson
Builder

@piebob - Yes we work closely together. mainly in regard to creating Splunk dashboards and views to be used within our company.

In actual fact, he's about a 1 min walk NW from my desk, to his. 😛

toby6578
Path Finder

Hi Mark,
Thanks for your answer, but Splunk does recognize it as a number and thus you are incorrect.

0 Karma

markthompson
Builder

Hi Toby,
Going by the definition of a "Number": a quantity or amount.

Hence making your field an alphanumeric value, which is recognised as a string.

Please remove your negative vote, as technically it is a valid answer.

0 Karma

toby6578
Path Finder

Maths would not be possible if it were a string. Please could you remove your answer as it is clearly invalid.

0 Karma

markthompson
Builder

Toby, I appreciate that Splunk allows you to do maths with the E in there.
But by Documentation of the Eval command (http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Eval)

Maths will be done with any Alphanumeric field (Does not need to be a Number), it will only error in the event it is a Non-Alphanumeric Field.

0 Karma

toby6578
Path Finder

Normally I would agree, however I believe in this case E is not recognised as a letter, but as its actual scientific meaning, which is *10^. If you wish to escalate this matter further we should arrange a place to meet and sort out our differences like real men, in the form of street countdown.

0 Karma

markthompson
Builder

HI Toby, Documentation is based on how the coding behind Splunk works, in the event you wish to argue this, please contact Splunk support (support@splunk.com) who i'm sure will be able to clarify why this works for you, or if you believe their documentation is wrong, be able to discuss it.

There is no room for disagreement and as such please remove your negative vote as it does not contribute to the community as they may believe it's not a correct answer, when in actual fact, it's factually correct.

0 Karma

toby6578
Path Finder

I will definitely email them later, but not to ask... To prove that I, Toby6578, am correct in this instance (and all others). I don't know who you are. I don't know what you want. If you are looking for badges, I can tell you I don't have karma. But what I do have are a very particular set of skills; skills I have acquired over a very long career. Skills that make me a nightmare for people like you. If you accept that i am correct, that'll be the end of it. I will not look for you, I will not pursue you. But if you don't, I will look for you, I will find you, and I will splunk you.

piebob
Splunk Employee
Splunk Employee

this is the best thing ever.

0 Karma

markthompson
Builder

I Appreciate your quote from Taken, credits to 20th century fox, but in the interest of helping the community, your behaviour on this site should reflect that as such to help the community by upvoting and accepting correct answers so that others who have similar questions can understand.

The down vote is designed to show that an answer is not correct and should probably only be used in rare circumstances where a member of the community is inaccurate in their answer and you believe this could be misleading to any other user.

0 Karma

toby6578
Path Finder

Your answer is wrong and thus deserves a down vote... In my opinion I am benefiting the community by allowing other users to easily see that your answer is not a valid response to this question. I accept that we have a difference of opinion, but this is my question and I will not back down. Leave me alone.

0 Karma

markthompson
Builder

Toby, this answer has been proven by the documentation and thus so should not be down voted. In the interest of the community please remove your down vote or I will be forced to report you for false down voting.

I accept you may see it as an alphanumeric value but alphanumeric is classed as a string in basic programming language, which you will notice once you have completed some training on the subject, Once you have achieved the same amount of gold badges as I have, then please don't hesitate to let me know and then I'll be happy to explain why it's classed as a string.

So, last time, please remove your negative vote, as it might not have been the answer you was looking for, but it is a factually valid answer and can be used in the future by other users

0 Karma

toby6578
Path Finder

I have been using splunk since version 0.1... I know how this stuff works. You don't. I will remove your down vote because I feel sorry for you. That is all.

0 Karma

markthompson
Builder

Toby, thanks for you co-operation and you will be recognised for helping the community, please strive to achieve as many badges as you can, but just out of interest, how comes you only joined Splunk answers in jan 2015?

0 Karma

toby6578
Path Finder

I felt I should give lesser mortals such as yourself a head start when it comes to gaining badges. My fountain of knowledge flows far too strong for simpler minds.

markthompson
Builder

Thanks for your concern, but in the interest of simplicity, lets stop this argument as it's no longer required and will not be an advantage to users, the fact is no answers have been unnecessarily down voted.

Anyway, good question I must say, I had the same issue on my dashboard. Similar numbers too.

0 Karma

toby6578
Path Finder

For more information on street countdown, watch The IT Crowd

0 Karma

toby6578
Path Finder

I have discovered that in fact splunk does know this is a number however it refuses to plot anything containing "E" on a graph, which is even more strange, but that's another question. You can do maths with a number containing E on splunk.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...