topic How to use thousand comma separator for chart command? in Splunk Search

How to use thousand comma separator for chart command?

ND — Wed, 13 Apr 2022 15:17:48 GMT

Hi Everyone,

below is my query to use thousand comma separator:

|inputlookup abc.csv | chart sum(field1) as field1 by field2, field3| addtotals | fieldformat/eval = tostring(field1, "commas").

in the result I am not getting commas in the field1 value. If I alter my query with only 1 field -> field2 or field3 then I get expected result. but I want sum of field by field 2 and field 3.

can someone help me with this issue?

Thanks,

ND.

Re: How to use thousand comma separator for chart command?

kamlesh_vaghela — Wed, 13 Apr 2022 15:59:30 GMT

@ND

Can you please try this?

| inputlookup abc.csv | chart sum(field1) as field1 by field2, field3 | addtotals | eval field1 = tostring(field1, "commas")

For further help can you please share sample output of below search?

| inputlookup abc.csv | chart sum(field1) as field1 by field2, field3 | addtotals

Thanks
KV

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.