Splunk Search

how to convert number to string using tostring function?

LearningGuy
Motivator

Hello,
how to convert number to string using tostring function?
I tried using tostring function, but the result is still number
See below.   Thank you!!

| makeresults

| eval num = 1
| eval var_type = typeof('num')

| eval num2 = tostring(num)
| eval var_type2 = typeof('num2')

 

LearningGuy_0-1711035209226.png

 

Labels (2)
0 Karma

LearningGuy
Motivator

They both became String.     Num should be number.  Thanks
LearningGuy_0-1711036391407.png

 

0 Karma

rvany
Communicator

It's a bit older but it seems to be some confusion around:

Your second example is completely different from the first one as you use double quotes, i.e.

 

| eval var_type = typeof("num")

 

"num" is a literal string which has nothing to do with your variable! Take care about using double quotes (for strings), single quotes (for field names, e.g. containing spaces (for whatever reason... 😉 )) or no quotes at all (also for field names).

Besides that to me it seems that this `tostring` function is buggy. If I convert any number using `tostring(number)` that should(!) become a string, regardless of any "format"-argument. And the "typeof()" function should then return "String" for this string.

Bildschirmfoto_2024-07-15_11-33-23.png

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy,

the second it's a string, you transformed it using the tostring function, infact you have the commas.

Ciao.

Giuseppe

LearningGuy
Motivator

@gcusello 
Yes but why the first one is also string?
The first one is number.
Should I remove " " from typeof?        Thanks

| makeresults
| eval num = 1 
| eval var_type = typeof(num)
| eval num2 = tostring("num")
| eval var_type2 = typeof(num2)

LearningGuy_0-1711036912855.png

 


Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @LearningGuy,

as I said, you have to say what kind of string you want:

| makeresults
| eval num = 1 
| eval var_type = typeof(num)
| eval num2 = tostring(num,"commas")
| eval var_type2 = typeof(num2)

Ciao.

Giuseppe

LearningGuy
Motivator

Hello @gcusello 

Sorry.. I tried again your last suggestion, but num and num2 still have type as "Number"
I expect num2 has "String" type after using   num2= tostring(num,"commas")  
Please suggest   Thanks again..

LearningGuy_0-1711042200468.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy ,

As I said, using 1000 instead of 1 you have a string.

I don't know why with a different number you have a different type.

You eventually could to try:

| makeresults
| eval num = 1 
| eval var_type = typeof(num)
| eval num2 = tostring(num,"commas")." "
| eval var_type2 = typeof(num2)

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy ,

see at https://docs.splunk.com/Documentation/SCS/current/SearchReference/ConversionFunctions

and try

| makeresults
| eval num = 1
| eval var_type = typeof('num')
| eval num2 = tostring(num, "commas")
| eval var_type2 = typeof('num2')

Ciao.

Giuseppe

LearningGuy
Motivator

Hello @gcusello ,

I tried and the same result..  see below..  thank you

LearningGuy_0-1711035919488.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy,

what does it happen running:

| makeresults
| eval num = 1000
| eval var_type = typeof("num")
| eval num2 = tostring(num, "commas")
| eval var_type2 = typeof("num2")

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...