Spread our blog

Usage of Splunk EVAL Function :TOSTRING

Usage of Splunk EVAL Function : TOSTRING

  • This function takes two arguments ( X and Y )
  • This functions converts inputs value to a string value .
  • If you give number as an input it formats the number as a string.
  • If you give Boolean value as an input it returns “True” or “False” corresponding to the Boolean value.
  • If the first argument ( X ) is a number then second argument(Y) can be “hex” , “commas” or “duration”.

Find below the skeleton of the usage of the function “tostring” with EVAL :

….. | eval NEW_FIELD=tostring(X,Y )

Example 1:

index=_internal sourcetype=splunkd_ui_access
| eval New_Field=tostring(1==1)
| table New_Field
| dedup New_Field

Result:

ts1

Explanation:

In the above query _internal is the index name and sourcetype name is splunkd_ui_access . We have given a Boolean value as a input of tostring function so it returns “True” corresponding to the Boolean value  and store the value in a new field called New_Field. Because 1==1 is an universal truth. At last by table function we have taken New_Field in tabular format and by dedup command we have removed the duplicate values from the result set.

*******************************************************************************

Example 2:

index=_internal sourcetype=splunkd_ui_access
| stats count as decimal by method
| eval Hex_Field=tostring(decimal,"hex")

Result:

ts2Explanation:

In the above query _internal is the index name and sourcetype name is splunkd_ui_access. By the stats command we have taken the count of method field values and rename the count field as decimal. Here method is an existing field name in _internal index.We have used “hex” as an argument with tostring function for eval command . This argument converts the decimal value into a hexa-decimal value . We have stored the hexa-decimal values in a new field called Hex_Field.

*********************************************************************************

You can also know about :  Usage Of Splunk EVAL Function : MVMAP

Example 3:

index=_internal sourcetype=splunkd_ui_access
| stats sum(bytes) as Summation by method
| eval Comma_Field=tostring(Summation,"commas")

Result:

ts3Explanation:

In the above query _internal is the index name and sourcetype name is splunkd_ui_access. By stats command we have taken the summation of bytes for every method field values and rename the field as Summation. Here method and bytes are existing field names in _internal index. We have used “commas” as an argument with tostring function for eval command  . This argument formats the Summation field with commas. If a field includes decimal values then it round offs to nearest two decimal point. We have store the values in a new field called Comma_Field.

*******************************************************************************

Example 4:

index=_internal sourcetype=splunkd_ui_access
| eval Second="33403"
| eval Duration=tostring(Second,"duration")
| table Second,Duration
| dedup Second,Duration

Result:

ts4Explanation:

In the above query _internal is the index name and sourcetype name is splunkd_ui_access. By the eval command we have created a field called Second. In the Second field we have stored “33403” as second value . We have used “duration” as an argument with tostring function for eval command. This argument converts seconds to readable time format ( HH:MM:SS ). We have store the time formatted  value in a new field called Duration. By table command we have taken Second and Duration fields in a tabular format and by dedup command we have removed the duplicate values from the result set.

Now you can effectively utilize “tostring” function with “eval” command to meet your requirement !!

 Hope you are now comfortable in : Usage of Splunk EVAL Function : TOSTRING


HAPPY SPLUNKING !!

What’s your Reaction?
+1
1
+1
+1
+1
+1
+1
+1

Spread our blog
Previous articleUsage of Splunk commands  : GEOM
Next articleUsage of Splunk EVAL Function: MVINDEX
Passionate content developer dedicated to producing result-oriented content, a specialist in technical and marketing niche writing!! Splunk Geek is a professional content writer with 6 years of experience and has been working for businesses of all types and sizes. It believes in offering insightful, educational, and valuable content and it's work reflects that.

1 COMMENT

  1. […] Explanation 1.1: Here we took data from the “_internal” index, and by using stats command took the count of every unique value of the “method” field. Then using the “tostring” function with “fieldformat” command we have created a new field “new_count”, which just converted the count fields values with commas. At last we have used the “outputlookup” command to save that result in the form of lookup. If you don’t know the functionalities of the “tostring” function then click here. […]

LEAVE A REPLY

Please enter your comment!
Please enter your name here