tostring turning integers into decimals

[rachelneal]

I have a rex that returns a series of 5-8 digit IDs:

SEARCH
"rex field=_raw "2012-\d\d-\d\d,\d,(?\d{1,8})""

RESULT (HotelID)

10645909
10645911
10645912
1065511
1065512

I need to trim the last 2 digits off of each of them so I used an expression that had worked before:
| eval Hotel=tostring(HotelID) | eval Hotel=rtrim(Hotel,substr(Hotel,-2))

and it's produces:

1.81733e+07
3.01515e+07
2.55715e+07
2.8893e+06
2.83481e+07
7.98262e+06
2.98611e+06
3.46589e+07

I've tried it with and without the tostring and get the same results. What is it converting to and how to I get it to stop? 🙂

[rachelneal · Accepted solution]

Well I'm not sure why it's doing it but I was given a simple regex that fixed it from the start.

(?\d+)\d{2} DOH!!!!

[gkanapathy]

appears to be a bug in the rtrim() (also trim()) function. Workaround is to use tostring() on the first argument:

| eval Hotel=tostring(HotelID) | eval Hotel=rtrim(tostring(Hotel),substr(Hotel,-2))

[gkanapathy]

or:

... | eval Hotel=substr(Hotel,0,len(Hotel)-2)