Why are fields returning true for both isNum() and isStr() ?

[rolaso]

Hi,

I want to setup a search to alarm me if a field ever changes its nature. To play around, I chose the year field in one of our indexes. This field appears to be numeric.

field k="date_year" c="20" nc="20" dc="1" exact="1" relevant="0"

All 20 counts are numeric, hence it should be numeric.

I would expect this simple search to have isNum=true and isStr=false for all fields:

index=foo
| eval isStr= if(isstr(date_year),"true","false")
| eval isNum= if(isnum(date_year),"true","false")
| table isNum,isStr, date_year

But this is what I get:

isNum isStr date_year
true true 2014
true true 2014
true true 2014

I have done some research, and I can't find any posts about this behaviour. Can someone explain to me why this is happening?

Many thanks!

R

[ppablo · Accepted solution]

Hi @rolaso

I think the reason isStr is returning "true" is because numeric values are also considered strings. I was just looking through Splunk documentation and found this:

"Numbers, for example, are strings that contain the number. For example, a field containing a value of the number 10 contains the characters 1 and 0: "10""

The date_year field will always be a number, so 2014 could be seen as containing the characters 2, 0, 1, 4: "2014", so it makes sense that | eval isStr= if(isstr(date_year),"true","false") would return "true".

[weidertc]

Is this a claim that isnum() and isstr() are deprecated?  This was working up until recently.  I've been scratching my head for hours trying to fix my dashboard.

If this is the case then there needs to be a way to find out if a string containing only numbers is indeed only numbers.

[rolaso]

Thank you for your reply, it makes perfect sense.

[Nikobobinus]

Under which scenarios does isstr return false then other than empty/null?

[ppablo]

No problem @rolaso glad I could clarify.