topic Re: Adding commas to "stats sum" in Splunk Search

Adding commas to "stats sum"

rattyryan — Wed, 05 Feb 2014 17:47:14 GMT

Hi,

I'm trying to add commas to the TotalPrints field as shown in the code below. I have tried the fieldformat=stringto but it just creates an empty additional TotalPrints field. Can someone please advise?

Also a quick one, how can I make the TotalPrints in descending order and limit it top top 10? I have tried sort- and limite=10 but it doesnt appear to do anything..

source="PrinterDemo.csv"
| multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets"
| table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints
| stats sum(TotalPrints) by "Location"

Re: Adding commas to "stats sum"

Ayn — Wed, 05 Feb 2014 18:09:49 GMT

Can you show what your search string when you tried to use fieldformat looked like?

Re: Adding commas to "stats sum"

rattyryan — Wed, 05 Feb 2014 18:48:29 GMT

Yup... at the end I've added

| fieldformat TotalPrints=tostring(TotalPrints,"commas")

and

|fieldformat "sum(TotalPrints)"=tostring(TotalPrints,"commas")

no joy.

Re: Adding commas to "stats sum"

somesoni2 — Wed, 05 Feb 2014 19:10:22 GMT

Try this

source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) as TotalPrints by "Location" | fieldformat TotalPrints=tostring(TotalPrints,"commas") | sort 10 -TotalPrints

Re: Adding commas to "stats sum"

David — Wed, 05 Feb 2014 19:12:36 GMT

Alternatively, you could use | fieldformat sum(TotalPrints) = tostring('sum(TotalPrints)', "commas") but I prefer somesoni2's approach!

Re: Adding commas to "stats sum"

rattyryan — Thu, 06 Feb 2014 10:10:41 GMT

Thanks very much 🙂