Splunk Search

how to convert number to string using tostring function?

LearningGuy
Motivator

Hello,
how to convert number to string using tostring function?
I tried using tostring function, but the result is still number
See below.   Thank you!!

| makeresults

| eval num = 1
| eval var_type = typeof('num')

| eval num2 = tostring(num)
| eval var_type2 = typeof('num2')

 

LearningGuy_0-1711035209226.png

 

Labels (2)
0 Karma

LearningGuy
Motivator

They both became String.     Num should be number.  Thanks
LearningGuy_0-1711036391407.png

 

0 Karma

rvany
Communicator

It's a bit older but it seems to be some confusion around:

Your second example is completely different from the first one as you use double quotes, i.e.

 

| eval var_type = typeof("num")

 

"num" is a literal string which has nothing to do with your variable! Take care about using double quotes (for strings), single quotes (for field names, e.g. containing spaces (for whatever reason... 😉 )) or no quotes at all (also for field names).

Besides that to me it seems that this `tostring` function is buggy. If I convert any number using `tostring(number)` that should(!) become a string, regardless of any "format"-argument. And the "typeof()" function should then return "String" for this string.

Bildschirmfoto_2024-07-15_11-33-23.png

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy,

the second it's a string, you transformed it using the tostring function, infact you have the commas.

Ciao.

Giuseppe

LearningGuy
Motivator

@gcusello 
Yes but why the first one is also string?
The first one is number.
Should I remove " " from typeof?        Thanks

| makeresults
| eval num = 1 
| eval var_type = typeof(num)
| eval num2 = tostring("num")
| eval var_type2 = typeof(num2)

LearningGuy_0-1711036912855.png

 


Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @LearningGuy,

as I said, you have to say what kind of string you want:

| makeresults
| eval num = 1 
| eval var_type = typeof(num)
| eval num2 = tostring(num,"commas")
| eval var_type2 = typeof(num2)

Ciao.

Giuseppe

LearningGuy
Motivator

Hello @gcusello 

Sorry.. I tried again your last suggestion, but num and num2 still have type as "Number"
I expect num2 has "String" type after using   num2= tostring(num,"commas")  
Please suggest   Thanks again..

LearningGuy_0-1711042200468.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy ,

As I said, using 1000 instead of 1 you have a string.

I don't know why with a different number you have a different type.

You eventually could to try:

| makeresults
| eval num = 1 
| eval var_type = typeof(num)
| eval num2 = tostring(num,"commas")." "
| eval var_type2 = typeof(num2)

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy ,

see at https://docs.splunk.com/Documentation/SCS/current/SearchReference/ConversionFunctions

and try

| makeresults
| eval num = 1
| eval var_type = typeof('num')
| eval num2 = tostring(num, "commas")
| eval var_type2 = typeof('num2')

Ciao.

Giuseppe

LearningGuy
Motivator

Hello @gcusello ,

I tried and the same result..  see below..  thank you

LearningGuy_0-1711035919488.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @LearningGuy,

what does it happen running:

| makeresults
| eval num = 1000
| eval var_type = typeof("num")
| eval num2 = tostring(num, "commas")
| eval var_type2 = typeof("num2")

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...