Convert Operations
printf
Description: Takes a formatted string and a set of parameters separated by commas.
In the example, res will receive the value "Float: 1.2 String: mystring Decimal: 00000000000000000022 Float: 123.34443320000 String: creating index, cause [api]".
... | eval res = printf("Float: %.1f String: %s Decimal: %020d Float: %11.11f String: %10s", 1.23, "mystring", 22, 123.3444332, "creating index, cause [api]")
tobool
Description: Takes a parameter and converts it to a boolean.
In the example, res will have the value true, res1 will have the value true, res2 will have the value false, and res3 will have the value false.
... | eval res=tobool("true"), res1=tobool(true), res2=tobool("123"), res3=tobool(false)
tonumber
Description: Takes a parameter and converts it to a number. Optionally, a second parameter can be a base indicator (from 2 to 36).
In the example, res will have the value 164, and res1 will have the value 1234.5.
... | eval res=tonumber("0A4",16), res1=tonumber(trim("12 34.5"))
tostring
Description: Takes a parameter and converts it to a string.
In the example, res will have the value "0A4", res1 will have the value "1234.5", and res2 will have the value "false".
... | eval res=tostring("0A4"), res1=tostring(1234.5), res2=tostring(false())
Additional options for tostring
| Function | Description |
|---|---|
HEX | Converts a number into hexadecimal |
COMMAS | Formats a number with commas for easier reading |
DURATION | Converts time in seconds into a human-readable format |
BYTES | Converts information size in bytes into a human-readable format |
QUANTITY | Converts large numbers into a human-readable format |
In the example, r1 will have the value "0xBC614E", r2 will have the value "12 345 678", r3 will have the value "4 months, 3 weeks, 1 day, 21 hours, 21 minutes, 18 seconds", r4 will have the value "11 MB", and r5 will have the value "12.35 million".
... | eval qq = 12345678, r1 = tostring(qq, "HEX"), r2 = tostring(qq, "COMMAS"), r3 = tostring(qq, "DURATION"), r4 = tostring(qq, "BYTES"), r5 = tostring(qq, "QUANTITY")