Hello,
I've checked many of the Answers pages, but to no avail.
In my table, the value "appears" to be converted from a string to a number. However, in the Interesting Fields, it still appears a...
See more...
Hello,
I've checked many of the Answers pages, but to no avail.
In my table, the value "appears" to be converted from a string to a number. However, in the Interesting Fields, it still appears as alphanumeric.
Here is one line of the event which contains the data I want to convert from string to number.
SAG.TXT | 100 B | 6.5 KB/s | ascii | 100%
Not concerned with the 1st, 4th, or 5th value in this event. Only 100 B and 6.5 KB/s. These have been regexed in props.conf.
file_size=100 B
file_transfer_rate=6.5 KB/s
Here is my SPL.
host=host1
| rex field=file_size "(?<fileSize>\d*)\s"
| rex field=file_transfer_rate "(?<fileTransRate>\d*.\d{1,6})"
| eval fs1=trim(fileSize)
| eval fs2=tonumber(trim(fileSize))
| convert rmunit(file_size) AS fs3
| table file_size, fileSize, fs1, fs2, fs3
Here are the results.
file_size is a string
fileSize appears to a number
fs1 appears to a number
fs2 is blank
fs3 appears to a number
However, here are the Interesting Fields.
All of them are alphanumeric, and fs2 is not present.
Thanks in advance for any guidance.
God bless,
Genesius
UPDATE
I have not worked with multivalue fields before. I didn't know that certain commands will not work on multivalue fields. Apologies for not mentioning in the original post.
Any ideas with this new information?