Splunk ignores and truncates thousand separator commas in automatically identified numeric field -
we have splunk spit out log statements latency=1,840 . splunk identifies latency = 1 latency=524 . splunk identifies latency = 524
splunk identitfies latency numeric takes value 1 , truncates other decimal values case 1. , timechart on average gets affected. hoping use "convert rmcomma" didn't latency field has been stripped of numbers , commas before supplying convert rmcomma.
also at: http://answers.splunk.com/answers/232083
question: "we have splunk spit out log statements" - mean? information coming from?
i think splunk seeing comma identifying "multi-valued field". splunk administrator change how parsed, not without answering earlier question.
do within search fix problem:
yoursearchhere | eval latency=if(mvcount(latency)>1,mvjoin(latency, ""),latency) | whateverelse
Comments
Post a Comment