Splunk Search

Why does convert num NOT follow a universal typecasting paradigm and NOT trim leading zeroes?

nick405060
Motivator

I guess the question is a bit facetious

But, I would still like to know what the (flawed) logic is behind this? It's like Splunk wants you to spend hours debugging or have poor data integrity.

| makeresults | eval test="06" | convert num(test) | eval test="".test | eval a=if(test="6","yes","WHY")

diogofgm
SplunkTrust
SplunkTrust

Check this please:

| makeresults | eval test=tonumber("06") | eval a=if(test="6","yes, splunk can cast to number","WHY")

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

nick405060
Motivator

Already noted in a comment on the question.

0 Karma

somesoni2
Revered Legend

See this version of your query:

| makeresults | eval test="06" | convert num(test) | eval test="".test | eval result1=if(test="6","just 6","NA") , result2=if(test="06", "zero padded 6", "NA"), result3=if(test=6,"number 6", "NA") 

nick405060
Motivator

ugh

0 Karma

nick405060
Motivator

PS for anyone looking for a workaround, not an explanation (which is what I am looking for in an answer), you can just use tonumber or ltrim etc

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...