<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: tostring commas and locale specific separators in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80566#M181830</link>
    <description>&lt;P&gt;My browser settings ? Just checked on both Safari (Mac OS X) and Chrome and nothing like that it's there ...&lt;/P&gt;

&lt;P&gt;Any pointers ?&lt;/P&gt;</description>
    <pubDate>Thu, 22 Mar 2012 16:18:40 GMT</pubDate>
    <dc:creator>arturo</dc:creator>
    <dc:date>2012-03-22T16:18:40Z</dc:date>
    <item>
      <title>tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80561#M181825</link>
      <description>&lt;P&gt;My question is whether or not the tostring command is locale specific. If the locale specifies commas as the decimal and periods as the separator will tostring do the the right thing? &lt;/P&gt;

&lt;P&gt;It might better if the option was tostring(&lt;FIELDNAME&gt;, "separators").&lt;/FIELDNAME&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 28 Feb 2012 16:23:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80561#M181825</guid>
      <dc:creator>colinj</dc:creator>
      <dc:date>2012-02-28T16:23:54Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80562#M181826</link>
      <description>&lt;P&gt;Yes, it might be better. But the "commas" operator is locale specific.&lt;/P&gt;

&lt;P&gt;[Update] I am wrong. After believing this for a long time, I was chagrined to find that it is untrue. The &lt;CODE&gt;commas&lt;/CODE&gt; operator of the &lt;CODE&gt;tostring&lt;/CODE&gt; command inserts commas. Always.&lt;/P&gt;

&lt;P&gt;@sowings has a solution:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;searchstring
| stats count
| eval count=tostring(count,"commas:)
| rex field=count mode=sed "s/,/./g"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 28 Feb 2012 16:33:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80562#M181826</guid>
      <dc:creator>lguinn2</dc:creator>
      <dc:date>2012-02-28T16:33:12Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80563#M181827</link>
      <description>&lt;P&gt;So the "commas" operator will do the right thing?&lt;/P&gt;</description>
      <pubDate>Thu, 15 Mar 2012 21:37:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80563#M181827</guid>
      <dc:creator>colinj</dc:creator>
      <dc:date>2012-03-15T21:37:39Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80564#M181828</link>
      <description>&lt;P&gt;Where can I configure "commas" as "locale specific" ??&lt;/P&gt;</description>
      <pubDate>Fri, 16 Mar 2012 16:23:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80564#M181828</guid>
      <dc:creator>arturo</dc:creator>
      <dc:date>2012-03-16T16:23:51Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80565#M181829</link>
      <description>&lt;P&gt;It's based on your browser settings.&lt;/P&gt;</description>
      <pubDate>Fri, 16 Mar 2012 20:04:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80565#M181829</guid>
      <dc:creator>lguinn2</dc:creator>
      <dc:date>2012-03-16T20:04:30Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80566#M181830</link>
      <description>&lt;P&gt;My browser settings ? Just checked on both Safari (Mac OS X) and Chrome and nothing like that it's there ...&lt;/P&gt;

&lt;P&gt;Any pointers ?&lt;/P&gt;</description>
      <pubDate>Thu, 22 Mar 2012 16:18:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80566#M181830</guid>
      <dc:creator>arturo</dc:creator>
      <dc:date>2012-03-22T16:18:40Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80567#M181831</link>
      <description>&lt;P&gt;Does not seem to be in my Swiss German settings&lt;/P&gt;</description>
      <pubDate>Wed, 12 Jun 2013 12:20:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80567#M181831</guid>
      <dc:creator>mplungjan</dc:creator>
      <dc:date>2013-06-12T12:20:33Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80568#M181832</link>
      <description>&lt;P&gt;&lt;A href="http://splunk-base.splunk.com/answers/10265/change-default-web-ui-locale"&gt;http://splunk-base.splunk.com/answers/10265/change-default-web-ui-locale&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 12 Jun 2013 12:44:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80568#M181832</guid>
      <dc:creator>mplungjan</dc:creator>
      <dc:date>2013-06-12T12:44:32Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80569#M181833</link>
      <description>&lt;P&gt;And my apologies for not coming back to this answer and fixing it sooner.&lt;/P&gt;</description>
      <pubDate>Tue, 24 May 2016 17:42:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80569#M181833</guid>
      <dc:creator>lguinn2</dc:creator>
      <dc:date>2016-05-24T17:42:26Z</dc:date>
    </item>
    <item>
      <title>Re: tostring commas and locale specific separators</title>
      <link>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80570#M181834</link>
      <description>&lt;P&gt;Actually that isn't complete. This would show 1234.56 as 1.234.56 when it is expected to see 1.234,56&lt;BR /&gt;
Add an extra 2 lines to fix it.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| eval count=tostring(count,"commas")
| rex field=count mode=sed "s/\./#/g"
| rex field=count mode=sed "s/,/./g"
| rex field=count mode=sed "s/#/,/g"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;make it into a macro if you need it a lot.&lt;/P&gt;</description>
      <pubDate>Wed, 14 Sep 2016 15:21:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/tostring-commas-and-locale-specific-separators/m-p/80570#M181834</guid>
      <dc:creator>bmunson_splunk</dc:creator>
      <dc:date>2016-09-14T15:21:14Z</dc:date>
    </item>
  </channel>
</rss>

