How to convert a derived field extraction column from double to string

Follow

Russell Williams

• July 20, 2016 17:43

I understand parsed fields are typically cast to string types. In my field extractions, I added some derived fields, which are the sum of other extracted fields. While the initial parsed fields end up string, the derived summed field ends up double. e.g. client_delete_fail per below | client_delete_error + client_delete_timeout + client_delete_nfound as client_delete_fail These fields are all integer counters, so I'd rather they be kept as string, to avoid inconsistencies later. Best way to achieve this.

0

• 

  Olaf Stein

  • July 20, 2016 18:04

  Hi Russel, you can type cast to number: http://help.sumologic.com/Search/Search_Query_Language/Search_Operators/Manually_Casting_String_Data_to_a_Number In your case: | client_delete_error + client_delete_timeout + client_delete_nfound as client_delete_fail as FIELD_NAME | number(FIELD_NAME) as FIELD_NAME or | number(client_delete_error + client_delete_timeout + client_delete_nfound as client_delete_fail) as FIELD_NAME Hope this helps Olaf

  0

  Comment actions Permalink

Please sign in to leave a comment.