https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680480#M232582 <P>That's the job for <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConversionFunctions#tostring.28.26lt.3Bvalue.26gt.3B.2C.26lt.3Bformat.26gt.3B.29" target="_blank" rel="noopener">tostring</A>.</P><LI-CODE lang="markup">| appendpipe [stats sum(*) as * by Number | foreach * [eval &lt;&lt;FIELD&gt;&gt; = tostring(&lt;&lt;FIELD&gt;&gt;, "commas")] | eval UserName="Total By Number: "]</LI-CODE><P>I'm not sure why you group by "Number" but evals "UserName".&nbsp;</P> Wed, 13 Mar 2024 04:14:18 GMT yuanliu 2024-03-13T04:14:18Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680413#M232557 <P><EM>Good afternoon everyone, I need your help in this way. I have a stats sum with the wild card *</EM></P><P><STRONG>|appendpipe [stats sum(*) as * by Number | eval UserName="Total By Number: "]</STRONG></P><P><BR /><EM>and I need to format with commas the sum(*) as *. </EM></P><P><EM>How I can do that? </EM></P><P><EM>Thank you</EM></P> Tue, 12 Mar 2024 16:18:24 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680413#M232557 BeautyData 2024-03-12T16:18:24Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680416#M232558 <P>It is not clear to me what your expected output would look like. Please can you share an example?</P> Tue, 12 Mar 2024 16:44:21 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680416#M232558 ITWhisperer 2024-03-12T16:44:21Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680424#M232562 <P>Hi! thank you for responding soon! I appreciate that.</P><P>I am trying to put commas formatting to my&nbsp; Totals Row that I builds with this :&nbsp;<STRONG>| appendpipe [stats sum(*) as * by Number | eval UserName="Total By Number: "]</STRONG></P><P>This is my row now:</P><P>--------------------------------------------------------------------------------------------<BR />Total By Number:&nbsp; &nbsp; &nbsp; &nbsp; 1905&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2229&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1303&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1845&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1409<BR />--------------------------------------------------------------------------------------------</P><P>&nbsp;</P><P>This is the row that I am looking for the formatting way :</P><P>--------------------------------------------------------------------------------------------<BR />Total By Number:&nbsp; &nbsp; &nbsp; &nbsp; 1,905&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2,229&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;13,03&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1,845&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1,409<BR />--------------------------------------------------------------------------------------------</P><P>&nbsp;</P><P>Thank you</P><P>&nbsp;</P> Tue, 12 Mar 2024 17:43:31 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680424#M232562 BeautyData 2024-03-12T17:43:31Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680428#M232564 <P>If it is in a dashboard, you could try the thousands separator option</P> Tue, 12 Mar 2024 18:21:47 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680428#M232564 ITWhisperer 2024-03-12T18:21:47Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680430#M232566 <P>It is a report.&nbsp;I did try with the format in the UI but this will lost when this run again with different dates.</P> Tue, 12 Mar 2024 18:25:55 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680430#M232566 BeautyData 2024-03-12T18:25:55Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680480#M232582 <P>That's the job for <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConversionFunctions#tostring.28.26lt.3Bvalue.26gt.3B.2C.26lt.3Bformat.26gt.3B.29" target="_blank" rel="noopener">tostring</A>.</P><LI-CODE lang="markup">| appendpipe [stats sum(*) as * by Number | foreach * [eval &lt;&lt;FIELD&gt;&gt; = tostring(&lt;&lt;FIELD&gt;&gt;, "commas")] | eval UserName="Total By Number: "]</LI-CODE><P>I'm not sure why you group by "Number" but evals "UserName".&nbsp;</P> Wed, 13 Mar 2024 04:14:18 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680480#M232582 yuanliu 2024-03-13T04:14:18Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680552#M232615 If you want just format those on display but not convert those to string then you should use command fielformat instead of eval inside foreach loop.<BR />I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop. If it didn't work then just use additional field name with eval and you could use original for calculations later. Wed, 13 Mar 2024 13:50:31 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680552#M232615 isoutamo 2024-03-13T13:50:31Z https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680658#M232657 <BLOCKQUOTE>I'm not sure if bug in fieldformat has already fixed or not. At least some earlier versions it didn't work correctly in all cases inside foreach loop.<HR /></BLOCKQUOTE><P>Nope. &nbsp;These are from 9.2.0.1.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="foreach-eval.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29744iFD4579FA50EB6125/image-size/medium?v=v2&amp;px=400" role="button" title="foreach-eval.png" alt="foreach-eval.png" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="foreach-fieldformat.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29745iCBCC0C564BA259E0/image-size/medium?v=v2&amp;px=400" role="button" title="foreach-fieldformat.png" alt="foreach-fieldformat.png" /></span></P><P>I begin to suspect that this is by design.</P><P>  </P> Thu, 14 Mar 2024 07:56:26 GMT https://community.splunk.com/t5/Splunk-Search/Format-with-commas-an-appendpipe-stats-sum-as-by-Number/m-p/680658#M232657 yuanliu 2024-03-14T07:56:26Z