HI somesoni2 thank you for your answer.
I meet some problem in splunk string,number
For example:
|eval test="123.4E-3" |fieldformat test=tonumber(test)|table test
your test will get 0.1234
If you text like this
|eval total=0 | eval test1="1.2000E-3" | eval test2="2.4000E-3" |eval test3=3.6000E-3
|foreach test* [fieldformat <<FIELD>>=tonumber(<FIELD>)]
|foreach test* [eval total=total+<<FIELD>>]
|table test*,total
test1 test2 test3 total
1.2000E-3 2.4000E-3 0.0036000 0.0072000
In this case test1 test2 test3 are numbers so you can add them together,even you Double quotes numbers.
You can see the column is number or text with right-justified or left-justified
How can I tell a field value's type (number or string) just by looking?
https://answers.splunk.com/answers/241582/how-can-i-tell-a-field-values-type-number-or-strin.html
or you can use isnum() isstr() to check type
In Splunk you can test like this to confirm column type
|eval total=0 | eval test1="1.2000E-3" | eval test2="2.4000E-3" |eval test3=3.6000E-3 |eval test4="12" |eval testd="12d"
|eval 1isnum=if(isNum(test1),"true","false")
|eval 2isnum=if(isNum(test2),"true","false")
|eval 3isnum=if(isNum(test3),"true","false")
|eval 4isnum=if(isNum(test4),"true","false")
|eval disnum=if(isNum(testd),"true","false")
|eval 1isstr=if(isstr(test1),"true","false")
|eval 2isstr=if(isstr(test2),"true","false")
|eval 3isstr=if(isstr(test3),"true","false")
|eval 4isstr=if(isstr(test4),"true","false")
|eval disstr=if(isstr(testd),"true","false")
|table 1* 2* 3* 4* d*
in this case test1~4 are number and string
your will get :
1isnum 1isstr 2isnum 2isstr 3isnum 3isstr 4isnum 4isstr disnum disstr
true true true true true true true true false true
Why are fields returning true for both isNum() and isStr()
https://answers.splunk.com/answers/241582/how-can-i-tell-a-field-values-type-number-or-strin.html
Is foreach is a bug to use tonumber?
Thank you
... View more