Splunk ignores and truncates thousand separator commas in automatically identified numeric field -


we have splunk spit out log statements latency=1,840 . splunk identifies latency = 1 latency=524 . splunk identifies latency = 524

splunk identitfies latency numeric takes value 1 , truncates other decimal values case 1. , timechart on average gets affected. hoping use "convert rmcomma" didn't latency field has been stripped of numbers , commas before supplying convert rmcomma.

also at: http://answers.splunk.com/answers/232083

question: "we have splunk spit out log statements" - mean? information coming from?

i think splunk seeing comma identifying "multi-valued field". splunk administrator change how parsed, not without answering earlier question.

do within search fix problem:

 yoursearchhere  | eval latency=if(mvcount(latency)>1,mvjoin(latency, ""),latency)  | whateverelse 

Comments

Popular posts from this blog

shopping cart - Page redirect not working PHP -

php - How to modify a menu to show sub-menus -

python - Installing PyDev in eclipse is failed -