To string (str)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

Converts an integer, float, timestamp, ip, geocoord or mac type value into string data type.

You can also extract a string value from a json (json data type) using the Jq evaluation (jqeval) operation and convert it into string type.

How does it work in the search window?

Select Create column in the search window toolbar, then select the To string operation. You need to specify one argument:

Argument	Data type

Argument	Data type
Date / Number ^mandatory	integer, float, timestamp, ip, geocoord, mac, json

The data type of the values in the new column is string.

When using the search window interface to manually introduce the content of the argument, it will be automatically converted into the data type that matches the format before actually converting it into string data type. However, you will not notice that such an intermediate step exists. For example, if you introduce coordinates, they will be automatically transformed in the background into geocoord data type and then into string.

Though most of these conversions are implicit while using the search window interface, they must be explicitly done when writing the query in LINQ. For example:

str(geocoord("40°24'46.2\"N 3°41'43.8\"W"))

Example

We have the following JSON string:

{"str": "hello", "int": 1, "float": 2.5, "boolean": true, "array": [1,2,3], "object": {"a": 5}}

And we want to extract the string value in it in a new column and convert it to string data type. To do it, the first step is transforming the string into a json data type column, and then using the Jq evaluation (jqeval) operation to extract the string parts from the JSON objects.

Step 1: Transform the JSON string into json data type

We use the To json (jsonparse) operation and enter the JSON string we want to use to get a column representing it in json data type.

Step 2: Extract the string value from the JSON objects

Then, we use the Jq evaluation (jqeval) operation to extract the string part of the JSON objects in a new column, in json data type. These are the required arguments:

jq - Click the pencil icon and enter .str
json - json column

Step 3: Transform the string values into string data type

Finally, we use the To string operation to transform the string representations in json data type into string data type.

Click Create column and you will see the following result:

How does it work in LINQ?

Use the operator select... as... and add the operation syntax to create the new column. These are the valid formats of the To string operation:

str(field)
str(json_string)

Example

You can copy the following LINQ script and try the second example explained above on the siem.logtrust.web.activity table.

from siem.logtrust.web.activity
select jsonparse("{\"str\": \"hello\", \"int\": 1, \"float\": 2.5, \"boolean\": true, \"array\": [1,2,3], \"object\": {\"a\": 5}}") as json
select jqeval(jqcompile(".str"), json) as jsonString,
str(jsonString) as String