Splunk Search

Why does the trim function not work on numeric values without spaces?

anantdeshpande
Path Finder

Hi,
We have a column where value can be string, alphanumeric, numeric, and with/without spaces before and after it.
Trim function works perfect for string, alphanumeric values with or without spaces. It also works when value is numeric with space.
However, when value is numeric and without any space, it displays in exponential format.

Trim works when data is like: "G12345", "G98765 ", "UPHAV", OUGNJGF ", "67537658 "

Trim displays in exponential when data is like: "98753567" (Number without space) displays like (1.49554e+09).

1) Is there any alternative to trim, which is generic and satisfies all above condition?
2) Can we have any if condition to find out a value which is numeric but without any space before and after it?

0 Karma
1 Solution

anantdeshpande
Path Finder

Hi all, Thanks for the comments. TRIM function on number without space in Splunk 6.2.0 is not working for us.
However cust_id=replace(cust_id, " ","") [there is space between first double cote] is working perfectly for all data with or without space.

View solution in original post

0 Karma

anantdeshpande
Path Finder

Hi all, Thanks for the comments. TRIM function on number without space in Splunk 6.2.0 is not working for us.
However cust_id=replace(cust_id, " ","") [there is space between first double cote] is working perfectly for all data with or without space.

0 Karma

nekbote
Path Finder

your spl does give exponential error in 6.2.2...

You can try appending space in your evail and then continue to use trim...this will ensure numric value with no space gets a space and your trim continues to work..below SPL works just fine

index=_internal sourcetype=splunkd | eval CUST_ID=1234567 |eval CUST_ID=CUST_ID." "| eval NEW_CUST_ID=trim(CUST_ID) | table NEW_CUST_ID

0 Karma

nekbote
Path Finder

with one less eval compared to previous one..
index=_internal sourcetype=splunkd | eval CUST_ID=12345678910 | eval NEW_CUST_ID=trim(CUST_ID." ") | table NEW_CUST_ID

0 Karma

niketn
Legend

How about when you convert from number to string?

   <your base search> | eval a=tostring(a) | eval b=trim(a)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Which version of Splunk are you using? What is your SPL? I can't reproduce this in 6.5.1.

---
If this reply helps you, Karma would be appreciated.
0 Karma

tkomatsubara_sp
Splunk Employee
Splunk Employee
| makeresults |eval a=98753567 | eval b=trim(a)

What do you mean?

This example shows no problem.

0 Karma

anantdeshpande
Path Finder

I am using Splunk 6.2
| makeresults |eval a=98753567 | eval b=trim(a) - using same in 6.2 is not working

Can anyone try and let us know if thats the limitation in 6.2

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The command makeresults is available only on 6.3.x and above. I've tried similar search (below) on 6.2.6 and 6.2.12 it works just fine.

| gentimes start=-1  |eval a=98753567 | table a | eval b=trim(a) 
0 Karma

anantdeshpande
Path Finder

Sorry, I am not using makeresults. My query looks like below:
Index=abc sourcetype=xyz | eval CUST_ID=123456 | eval NEW_CUST_ID=trim(CUST_ID)

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Would you be able to post a screenshot of the search result? Something similar works just fine for me on 6.2.6.

index=_internal sourcetype=splunkd | eval CUST_ID=123456 | eval NEW_CUST_ID=trim(CUST_ID)
0 Karma

anantdeshpande
Path Finder

Hi,
Looks like issue is when digits are more than 6 digits. works when CUST_ID is 123456 but gives exponential when CUST_ID is 1234567 . Please try on Splunk 6.2 .

index=_internal sourcetype=splunkd | eval CUST_ID=1234567 | eval NEW_CUST_ID=trim(CUST_ID)

0 Karma

anantdeshpande
Path Finder

also, our Splunk is 6.2.0

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...