Splunk Search

Format Result set Numbers

lpolo
Motivator

I have the following result set:

_time                       Visits
Sunday, November 27, 2011   667044
Saturday, November 26, 2011 659234
Sunday, November 20, 2011   648686
Saturday, October 29, 2011  640808

Is there a way to format the Visits' number as follow?

_time                       Visits
Sunday, November 27, 2011   667,044
Saturday, November 26, 2011 659,234
Sunday, November 20, 2011   648,686
Saturday, October 29, 2011  640,808

Regards,
Lp

Tags (1)
1 Solution

tgow
Splunk Employee
Splunk Employee

You can use the fieldformat command to accomplish this.

Try this in search:

| fieldformat Visits = tostring(Visits, "commas") | table _time, Visits

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/4.2.4/SearchReference/Fieldformat

View solution in original post

tgow
Splunk Employee
Splunk Employee

You can use the fieldformat command to accomplish this.

Try this in search:

| fieldformat Visits = tostring(Visits, "commas") | table _time, Visits

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/4.2.4/SearchReference/Fieldformat

lpolo
Motivator

It worked great.

Thanks.
Lp

0 Karma

banchio
Engager

Hi everybody!
This solution is great, but if you change column values to string you'll lose the ability to automatically calculate column totals: such totals will be wrong since they'll ignore every value containing commas.
Is there a way to apply this formatting without invalidating "|addcoltotals" functionalities?

Thank you very much in advance,
Matteo

-- EDIT --
SOLUTION is to pospone | eval tostring(...,"commas") to |addcoltotals: then everything is working fine!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...