topic Re: Keep numbers right-aligned after using fieldformat in Splunk Search

Keep numbers right-aligned after using fieldformat

mjosen — Mon, 21 Jul 2014 17:12:39 GMT

Hello,

I have a numeric field that I convert to a comma separated number using fieldformat. The only problem is that after the conversion it changes the format from right align to left align. Since this is a numeric field, is there anyway to keep the column right-aligned with commas? It's very difficult to compare numbers within a column when they are all left-aligned. Thanks.

Re: Keep numbers right-aligned after using fieldformat

rettops — Wed, 17 Sep 2014 15:55:53 GMT

Did you ever find a solution to this? I'm looking for the same thing - some way to force the chart's text alignment to right align.

Re: Keep numbers right-aligned after using fieldformat

jrodman — Wed, 17 Sep 2014 16:42:09 GMT

This is tricky, because the fields don't have any alignment, they're just strings in a conceptual table. However, the UI tries to make some guesses on how to display them based on their content.

Thus there's little in the search language that can control the UI behavior (unless we implement some kind of ui-hint-field which doesn't currently exist). Some more direct control in the UI would be nice, but that wouldn't persist cleanly in a search for all users. I think this boils down to an Enhancement Request.

Re: Keep numbers right-aligned after using fieldformat

cchange — Wed, 09 Nov 2016 23:28:47 GMT

Do we have any solution in v6.5 for this issue?

Re: Keep numbers right-aligned after using fieldformat

Flynt — Tue, 15 Nov 2016 21:23:34 GMT

How are you using fieldformat? Using the example below, it appears to right format in 6.5.0 when using tostring "commas".

|stats count|fields - count |eval number=10000  |fieldformat formattednumber=tostring(number,"commas")

Re: Keep numbers right-aligned after using fieldformat

season88481 — Tue, 21 Mar 2017 01:53:43 GMT

Same problem here. We are using v6.4. And column became left-aligned after applying a fieldformat command.

Re: Keep numbers right-aligned after using fieldformat

niketn — Tue, 21 Mar 2017 11:32:10 GMT

@cchange and @season88481...Can you give example of query / mock data? It works fine for me in 6.4.3 as well as 6.5. Following is the run anywhere search I tested:

| makeresults
| eval TestNumber=12345678912345
| fieldformat TestNumber=tostring(TestNumber,"commas")
| table _time TestNumber

Re: Keep numbers right-aligned after using fieldformat

lguinn2 — Wed, 22 Mar 2017 06:33:49 GMT

In Splunk 6.5, you can format a table column in a dashboard. You can apply both numeric and color formatting. This is preferable to using the fieldformat command.

fieldformat never worked consistently (when combined with other commands) to display a formatted numeric value while preserving the underlying field as numeric.

Here is the documentation showing how to Format table visualizations.