tonumber

The tonumber eval function converts string fields into floating point numbers so that the data can be applied to additional calculations. If a result cannot be expressed as a number, Search leaves the field empty.

• Syntax
• Parameters
• How Do I Use This?

Syntax

suboperator : tonumber								

search_criteria | eval alias_name = tonumber one_field)

where:

• search_criteria represents a non-pipe operator query statement, such as “deviceVendor IS NOT NULL.”

• alias_name represents a valid field alias.

• one_field represents a valid field as a parameter for "tonumber."

Parameters

There can be only one fieldName such as a device vendor or a version.

How Do I Use This?

Use tonumber to convert string values to numbers.

• Create a search query that converts log messages to numbers:

  | eval messagesAsNumber = tonumber ( message )

• Create a search query that converts vendor devices to numbers:

  | eval x = tonumber ( deviceVendor )  

• Create a search query that checks for vendor device data that is not NULL and convert the data from version fields to numbers:

  deviceVendor IS NOT NULL | eval test = abs ( 10 ) + 10 | eval toNumberAlias = tonumber(version) | eval test2 = abs (13)

• Filter the data for those entries where ArcSight is the device vendor. Transform the version to a number and the device's custom number to a string value:

  Device Vendor = "ArcSight" | eval toNumberAlias = tonumber(version) | eval numberToString = tostring (deviceCustomNumber1)

 

For information about other operators, functions, and syntax requirements, see Use an Operator in the Query.