Splunk Search

string to decimal and use where condition

lain179
Communicator

I have extracted a field that represents how long a process takes. The values looks like 1.0435, 2.242, 234.23435, etc. Using rex, the values are stored as string, so I use convert auto(timetaken). Though it seems to convert it to number, I couldn't get the where clause to work. I searched for where timetake>1, and I got much fewer results than I expected. Please help. Thanks.

Here is my search syntax.

sourcetype="Engine Logs" done save | rex field=_raw ".*in (?<TimeTaken>[0-9\.]+) seconds.*SERVER\.(?<Server>.*)\.Engine" | convert auto(TimeTaken) | stats values(TimeTaken) as TimeTaken by Server | search TimeTaken>1
Tags (1)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

It would help if you posted your actual search. Typically, when using rex to extract a field and the regex extract numbers, including decimals, Splunk will take care of typing. So you don't really have to call convert. In any case, where should work in filtering things out.

Try this:

index=_internal sourcetype="splunkd_access" HTTP | head 100 | rex "HTTP/(?<http_version>[^\"]+)" | where http_version>1

and you should only see events with that contain "HTTP/1.1" but no "HTTP/1.0"

Alternatively, you can use search instead of where. Ex. | search timetaken>1

View solution in original post

0 Karma

lain179
Communicator

Oh never mind, I found what went wrong. When a server has multiple values - some less than 1 and some more than 1, that server doesn't return in the result for search TimeTaken>1. I have to do the stats by Sever, _time. And that worked.

0 Karma

_d_
Splunk Employee
Splunk Employee

It would help if you posted your actual search. Typically, when using rex to extract a field and the regex extract numbers, including decimals, Splunk will take care of typing. So you don't really have to call convert. In any case, where should work in filtering things out.

Try this:

index=_internal sourcetype="splunkd_access" HTTP | head 100 | rex "HTTP/(?<http_version>[^\"]+)" | where http_version>1

and you should only see events with that contain "HTTP/1.1" but no "HTTP/1.0"

Alternatively, you can use search instead of where. Ex. | search timetaken>1

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...