Splunk Search

converting an triming field values

codedtech
Path Finder

I need to to convert this field in to a number and remove the $ capacity_gb = $8,191.75, I've tried eval to num and convert, but nothing worked.

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval capacity_gb = "$8,191.75" 
| eval capacity_gb = replace(capacity_gb,"\$","")
0 Karma

renjith_nair
Legend

@codedtech .

Try

|rex mode=sed field=capacity_gb "s/[^\d\.]//g"

If you need , also part of you value, just add , to the square bracket

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To clarify, what do you get from | eval x = tonumber(capacity_gb) | table capacity_gb x ?

---
If this reply helps you, Karma would be appreciated.
0 Karma

codedtech
Path Finder

Yes, and the output is displayed like this:
capacity_gb x
$8,191.75

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...