KNOWLEDGE BASE

Mixed Data Type Fields Extract Incorrectly From Splunk


Published: 25 Feb 2019
Last Modified Date: 28 Feb 2019

Issue

Extracted Splunk data is incorrect, as Tableau does not handle user-specified data types (Number -> String) in extracting.

Environment

  • Tableau Desktop 10.5.9
  • Splunk

Resolution

This behavior is caused by a known issue, ID 856507, which is currently being investigated.

As a potential workaround, append the following to the Splunk query: 

| eval text.customer=tostring("'".'<fieldname>'."'")

You can then use a calculated field to replace single quotes with nothing, effectively stripping them out. 

REPLACE([SplunkFieldTextValue],"'","")

Cause

Extract based on Splunk data is incorrect, as Tableau does not handle user-specified data types (Number -> String) in extracting.

Known issue, ID 856507, is under investigation.
Did this article resolve the issue?