Splunk Search

converting an triming field values

codedtech
Path Finder

I need to to convert this field in to a number and remove the $ capacity_gb = $8,191.75, I've tried eval to num and convert, but nothing worked.

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval capacity_gb = "$8,191.75" 
| eval capacity_gb = replace(capacity_gb,"\$","")
0 Karma

renjith_nair
Legend

@codedtech .

Try

|rex mode=sed field=capacity_gb "s/[^\d\.]//g"

If you need , also part of you value, just add , to the square bracket

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To clarify, what do you get from | eval x = tonumber(capacity_gb) | table capacity_gb x ?

---
If this reply helps you, Karma would be appreciated.
0 Karma

codedtech
Path Finder

Yes, and the output is displayed like this:
capacity_gb x
$8,191.75

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...