Splunk Search

converting an triming field values

codedtech
Path Finder

I need to to convert this field in to a number and remove the $ capacity_gb = $8,191.75, I've tried eval to num and convert, but nothing worked.

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval capacity_gb = "$8,191.75" 
| eval capacity_gb = replace(capacity_gb,"\$","")
0 Karma

renjith_nair
Legend

@codedtech .

Try

|rex mode=sed field=capacity_gb "s/[^\d\.]//g"

If you need , also part of you value, just add , to the square bracket

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To clarify, what do you get from | eval x = tonumber(capacity_gb) | table capacity_gb x ?

---
If this reply helps you, Karma would be appreciated.
0 Karma

codedtech
Path Finder

Yes, and the output is displayed like this:
capacity_gb x
$8,191.75

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...