Casting Data to a Number or String

Most data in Sumo Logic is stored as a string data type. Metadata fields are stored as string data and parsed fields are by default parsed as string type data. Sumo Logic will implicitly cast string data to a number type assuming it is clear that you need a number to perform an action, such as a math calculation or when using a function like sum or avg. However, if there is any ambiguity about whether a number is required, the data remains string data.

Syntax 1�7/a>

This detail can be important when you are building queries. There are at least two cases where you will need to manually cast string data to a number so that you get the results that you expect:

When using the where operator to match integers like this:
- where value in (integer_value1, integer_value2, integer_value3)
- where value not in (integer_value1, integer_value2, integer_value3)
When you need to numerically sort a series of results from a query, like in this example:
```
* | parse "took *ms" as duration | toLong(duration) | sort by duration
```

In the first case, if your statement looks something like "where some_value in (1, 2, 4, 16)" and you need to match (or not match) integers, then you will first need to cast "some_value" to a number.

In the second case, the results will sort out of order as text values if you do not first cast the field "duration" to a number. After the field is cast to a number type, the sort order will produce expected results.

Sumo Logic accepts these functions for casting string data to a number:

num() or number()
toLong()

You can use the function toString() to cast data to a string.

Example 1�7/a>

When casting a field, remember to separate the casting statement with a pipe, like this:

* | parse "OSload *ms" as boot_time | number(boot_time)