I have the following result set:
_time Visits
Sunday, November 27, 2011 667044
Saturday, November 26, 2011 659234
Sunday, November 20, 2011 648686
Saturday, October 29, 2011 640808
Is there a way to format the Visits' number as follow?
_time Visits
Sunday, November 27, 2011 667,044
Saturday, November 26, 2011 659,234
Sunday, November 20, 2011 648,686
Saturday, October 29, 2011 640,808
Regards,
Lp
You can use the fieldformat command to accomplish this.
Try this in search:
| fieldformat Visits = tostring(Visits, "commas") | table _time, Visits
Here is a link to more information:
http://docs.splunk.com/Documentation/Splunk/4.2.4/SearchReference/Fieldformat
You can use the fieldformat command to accomplish this.
Try this in search:
| fieldformat Visits = tostring(Visits, "commas") | table _time, Visits
Here is a link to more information:
http://docs.splunk.com/Documentation/Splunk/4.2.4/SearchReference/Fieldformat
It worked great.
Thanks.
Lp
Hi everybody!
This solution is great, but if you change column values to string you'll lose the ability to automatically calculate column totals: such totals will be wrong since they'll ignore every value containing commas.
Is there a way to apply this formatting without invalidating "|addcoltotals" functionalities?
Thank you very much in advance,
Matteo
-- EDIT --
SOLUTION is to pospone | eval tostring(...,"commas") to |addcoltotals: then everything is working fine!