https://community.splunk.com/t5/Splunk-Search/Format-results-with-comma-thousands-separator/m-p/58163#M14208 <P>You can use the <CODE>tostring(X, "commas")</CODE> function in eval (http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions):</P> <PRE><CODE>eventtype=request | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 100 </CODE></PRE> Sat, 25 Sep 2010 01:52:09 GMT Stephen_Sorkin 2010-09-25T01:52:09Z https://community.splunk.com/t5/Splunk-Search/Format-results-with-comma-thousands-separator/m-p/58162#M14207 <P>How do I format the output to have comma separators - I want 1,234,567, not 1234567. Any easy way?</P> <P>Given a query like:</P> <PRE><CODE>eventtype=request | sistats sum(http_bytes) as bytes by http_domain | sort -bytes | head 100 </CODE></PRE> <P>I'd like bytes to be more human readable.</P> Sat, 25 Sep 2010 01:42:49 GMT https://community.splunk.com/t5/Splunk-Search/Format-results-with-comma-thousands-separator/m-p/58162#M14207 Oren 2010-09-25T01:42:49Z https://community.splunk.com/t5/Splunk-Search/Format-results-with-comma-thousands-separator/m-p/58163#M14208 <P>You can use the <CODE>tostring(X, "commas")</CODE> function in eval (http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions):</P> <PRE><CODE>eventtype=request | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 100 </CODE></PRE> Sat, 25 Sep 2010 01:52:09 GMT https://community.splunk.com/t5/Splunk-Search/Format-results-with-comma-thousands-separator/m-p/58163#M14208 Stephen_Sorkin 2010-09-25T01:52:09Z https://community.splunk.com/t5/Splunk-Search/Format-results-with-comma-thousands-separator/m-p/58164#M14209 <P>If you said that, I can't draw chart(or graph). </P> Tue, 30 Apr 2013 04:01:10 GMT https://community.splunk.com/t5/Splunk-Search/Format-results-with-comma-thousands-separator/m-p/58164#M14209 juanxiayan 2013-04-30T04:01:10Z