topic Re: Treating comma separated values as numbers in Pivot data model attribute definition in Reporting

Treating comma separated values as numbers in Pivot data model attribute definition

gregbujak — Fri, 18 Oct 2013 19:49:13 GMT

This question is specific to the new Pivot functionality in Splunk 6.

I have built up my data model, defined all the attributes and am ready to crunch my data.
However, I have a field/attribute (notional) that is a numeric field with comma formatting (ex. 1,000,000).

What is the process for eliminating the comma so that I can properly define it as a number?

I understand how to do this in regular search but cant figure out the secret sauce for pivot.

Thanks

Re: Treating comma separated values as numbers in Pivot data model attribute definition

Simon_Fishel — Fri, 18 Oct 2013 23:34:57 GMT

In the data model editor, you should be able to define an Eval attribute and do whatever you would do in regular search.

Re: Treating comma separated values as numbers in Pivot data model attribute definition

gregbujak — Mon, 28 Sep 2020 15:01:12 GMT

You are correct in a very general way.
Following:
http://answers.splunk.com/answers/36792/how-to-sum-numbers-with-commas
Using rex: "(?.)" | convert rmcomma(stripped_notional)
The result was empty.
Using rex: setting field to notional
"(?.)"| rex field=stripped_notional mode=sed "s/,//g"
Caused a parse error in "//g"

Using eval: setting field to stripped_notional and then the eval expression: replace(notional, ",", "")
finally worked.