Splunk Search

Why does convert num NOT follow a universal typecasting paradigm and NOT trim leading zeroes?

nick405060
Motivator

I guess the question is a bit facetious

But, I would still like to know what the (flawed) logic is behind this? It's like Splunk wants you to spend hours debugging or have poor data integrity.

| makeresults | eval test="06" | convert num(test) | eval test="".test | eval a=if(test="6","yes","WHY")

diogofgm
SplunkTrust
SplunkTrust

Check this please:

| makeresults | eval test=tonumber("06") | eval a=if(test="6","yes, splunk can cast to number","WHY")

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

nick405060
Motivator

Already noted in a comment on the question.

0 Karma

somesoni2
Revered Legend

See this version of your query:

| makeresults | eval test="06" | convert num(test) | eval test="".test | eval result1=if(test="6","just 6","NA") , result2=if(test="06", "zero padded 6", "NA"), result3=if(test=6,"number 6", "NA") 

nick405060
Motivator

ugh

0 Karma

nick405060
Motivator

PS for anyone looking for a workaround, not an explanation (which is what I am looking for in an answer), you can just use tonumber or ltrim etc

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...